--- title: Building materials firm Knauf hit by Black Basta ransomware description: The Knauf Group, a German-based multinational producer of construction materials, has announced that it's been the target of a cyberattack. The incident took place on the night of June 29, forcing its global IT team to shut down email systems, although communications were still possible via mobile devices and Microsoft Teams. canonical_url: https://www.acronis.com/en/tru/posts/building-materials-firm-knauf-hit-by-black-basta-ransomware/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 25 July 2022 # Building materials firm Knauf hit by Black Basta ransomware The Knauf Group, a German-based multinational producer of construction materials, has announced that it's been the target of a cyberattack. The incident took place on the night of June 29, forcing its global IT team to shut down email systems, although communications were still possible via mobile devices and Microsoft Teams. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=CvPJKRoL0ao) The Knauf Group, a German-based multinational producer of construction materials, has announced that it's been the target of a cyberattack. The incident took place on the night of June 29, forcing its global IT team to shut down email systems, although communications were still possible via mobile devices and Microsoft Teams. Knauf is still in the process of forensic investigation, incident response and remediation. The firm is an undeniably high-value target for cybercriminals, with more than 35,000 employees worldwide and an annual revenue of over $11 billion. Knauf operates 150 production sites in several countries, and owns U.S.-based USG Corporation and Knauf Insulation (which has been impacted as well). The Black Basta ransomware group has taken responsibility for the attack via an announcement on their extortion site, listing Knauf as a victim on July 16, 2022. The cybercrime gang has already published 20% of the stolen files, including samples of email communication, user credentials, employee contact information, production documents and ID scans. The [Active Protection](https://www.acronis.com/en-us/technology/active-protection/) in Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) detects and blocks ransomware threats like Black Basta based on the malicious behaviors that they exhibit, while [the Advanced Email Security pack](https://www.acronis.com/en-us/products/cloud/cyber-protect/email-security/) keeps dangerous payloads out of your users' inboxes. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)