Sustainability Business division of Schneider Electric

• •Schneider Electric Global Incident Response team was mobilized to respond to the attack, contain the incident, and to reinforce existing security measures
• •Sustainability Business critical resources were taken offline as a preventive measure
• •Reported the incident to law enforcement
• •Investigation, performed by a third party digital forensics and incident response (DFIR) consultant, SentinelOne
• •Brought back online on January 31, 2024
• •Completed its review of the data
• •Began mailing notification letters
• •Offering 24 months of complimentary credit monitoring and fraud protection services

• •Installation of SentinelOne
• •Activating SentinelOne Vigilence 24/7 MDR service to enhance threat investigation and response resources
• •Implementing specifically tailored, preventive, custom rules based on the documented Tactics, Techniques, and Procedures by the ongoing forensic investigation
• •Utilizing a SentinelOne threat hunting service to search the environment for known and emerging threats in real-time
• •Employing SentinelOne’s Digital Forensics and Incident Response (DFIR) team to investigate and contain the incident
• •Reviewing and actively monitoring CDN, our web application firewall, to protect Resource Advisor against DOS (denial of service) and DDOS (distributed denial of service) attacks
• •Performing a post-restoration system vulnerability scan before reenabling access to Resource Advisor
• •Enhancing the Sustainability Division’s Zero Trust network controls
• •Increasing Schneider Electric’s threat intelligence monitoring of the DarkWeb and relevant hacker group

DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).