Garmin says a ransomware attack occurred on July 23 but there's “no indication” customer data was stolen, expects to return to normal operation in a few days
TAREN STANTON, FRONT RANGE FLIGHT SCHOOL A Cyberattack on Garmin Disrupted More Than Workouts | WIRED https://www.wired.com/... @wired : Runners and athletes weren't the only ones affected by the cyberattack on Garmin. The outages hindered pilots who use Garmin products for position, navigation, and timing services in airplanes https://www.wired.com/... Per Thorsheim / @thorsheim : Finally. Now this is a press release. It is not an explanation, a status update, an apology or a good ETA for operations. But it is at least something. https://twitter.com/... Andy Beal / @andybeal : We all figured that out. The unanswered question is why did @Garmin hide the truth for 5 days and ignore everyone? Not exactly inspiring transparency and trust. https://techcrunch.com/... via @techcrunch Catalin Cimpanu / @campuscodi : Was told on Thursday they didn't want to pay. I guess they changed their mind by Saturday I'd wager they realized that re-imaging thousands of servers and workstations and restoring from backups takes months (see Maersk case as example) and not days, as they initially hoped https://twitter.com/... Kim Zetter / @kimzetter : Hmm. Garmin did not “directly” make a payment to Evil Corp. “Sources with knowledge of the Garmin incident... said that the company - an American multinational which is publicly listed on the NASDAQ - did not directly make a payment to the hackers.” https://uk.news.yahoo.com/... Zack Whittaker / @zackwhittaker : The whole sanctions thing is a bit messy. If Garmin paid the ransom, it might've violated sanctions law — longer version at the link. A fairly unique case (I think?) but imagine it won't be the last time something like this happens. https://techcrunch.com/... Catalin Cimpanu / @campuscodi : Five days later, Garmin confirms ransomware attack https://www.businesswire.com/ ... https://twitter.com/... Gabriel / @gabrielp237 : @Techmeme @zackwhittaker Yeah, right. They just gained access to all the severs but didn't exfiltrate any data, no reverse shell, nothing. Chris Welch / @chriswelch : Garmin confirms it was the victim of a cyber attack that “encrypted some of our systems” and caused a lengthy outage. Garmin Connect has since returned. Statement doesn't address whether or not Garmin paid a ransom to get services back online... https://www.theverge.com/... Joe Tidy / @joetidy : Garmin just published an update confirming it was a victim of ‘a cyber attack that encrypted some of our systems’. So, ransomware then. No mention of whether they paid hackers. Inviting shareholders to a briefing on Weds. https://newsroom.garmin.com/ ... Kim Zetter / @kimzetter : Interesting dilemma for Garmin and other victims of ransomware attacks done by Russian hacking group Evil Corp. Because Treasury Dept sanctioned Evil Corp, @zackwhittaker notes, US victims paying a ransom to them would technically be violating sanctions https://techcrunch.com/...
Context & Ripple Effects
Garmin's confirmation closes out a week of escalating disclosure: after shutting down its website, Garmin Connect, and Asian production lines over the July 24–25 weekend, an employee confirmed the servers were hit by WastedLocker, the ransomware strain built by Russia-based Evil Corp. Today's statement adds only two facts — no indication of customer data theft, and a return-to-normal window of 'a few days.'
The thinness of that statement is itself the story: security observers like Per Thorsheim called it neither an explanation nor a good ETA, while WIRED reporting showed the outage reached past athletes into cockpits, disrupting pilots who rely on Garmin for position, navigation, and timing. A fitness-platform outage turned out to be an aviation-infrastructure event.
First-order effects
- Garmin's customers — runners syncing Garmin Connect and pilots using its avionics services — get a recovery timeline rather than an explanation, while its Asian production lines restart after a multi-day halt.
- Garmin's 'no indication' framing on data theft caps immediate breach-disclosure exposure, though the company has not confirmed or denied paying Evil Corp, with accounts still conflicting.
Second-order effects
- The unresolved ransom question lands in a live precedent: travel firm CWT's leaked negotiation ended in a $4.5M bitcoin payment, so every day Garmin stays silent fuels the same victim-pays debate — with extra legal weight because Evil Corp sits under US sanctions.
- Rivals in connected fitness and general-aviation avionics now have to answer their own continuity questions, since Garmin's week-long outage demonstrated that single-vendor navigation and training platforms are a shared point of failure.
Third-order effects
- [[a:971989|Evil Corp later resurfaced against Sinclair under changed names to dodge its sanctions designation]] — meaning victims of this group operate in a legal gray zone where paying up risks sanctions exposure, pushing ransomware response from IT decision to compliance decision.
- If always-on consumer clouds keep doubling as critical infrastructure — fitness today, flight navigation tomorrow — regulators will face pressure to treat platform uptime and breach disclosure as aviation-grade obligations rather than app-store courtesy.
The trend: Ransomware is shifting from data-theft incidents to availability attacks on consumer platforms that quietly carry critical functions, with sanctioned crews like Evil Corp forcing victims to weigh payments against legal exposure.