Security Notice Regarding the IT Security Incident on the LPKF Websites

As of September 29, 2026

LPKF has detected an IT security incident related to its website. Based on current information, the website was compromised on September 26, 2026, at approximately 3:30 p.m.

In the process, individual files on the website were tampered with. As a result, visitors may have been shown a fake security, Cloudflare, or CAPTCHA prompt starting at that time.

This tampered prompt may have instructed visitors to perform certain keyboard shortcuts in Windows—for example, pressing the Windows key + R, then pasting content and executing it.

This prompt was not part of the LPKF website and did not constitute a legitimate security check.

Did you see such a prompt?

If you visited our website after 3:30 p.m. on September 26, 2026, and saw such a security prompt but did not carry out any of the displayed Windows instructions, we currently have no evidence that malicious code was executed on your device solely as a result of this fake prompt being displayed.

Did you follow the displayed Windows instructions?

If you followed the displayed instructions and executed a command via Windows “Run”, PowerShell, or the Command Prompt, we strongly recommend a security check of the affected device.

In this case, please note the following:

• Have the affected device checked promptly by your IT department or an IT security expert.
• If the device is used for business purposes, please notify the responsible IT department immediately.
• Companies should inform their IT security team or Security Operations Center (SOC) about the incident.
• If an EDR/XDR security solution is deployed on the device, verify whether it detected the execution and successfully blocked or terminated the relevant process.
• Until the security review is complete, avoid using the affected device for sensitive or business-critical logins until the password for the IT system has been changed.

What do we know about the malicious code that was executed?

Based on our findings to date, executing the manipulated command through manual user intervention triggered a malicious process that attempted to retrieve additional malicious code from external infrastructure.

The downstream malicious code could not be conclusively analyzed as part of the security analysis conducted so far. Despite various attempts at analysis, it was no longer possible to retrieve a copy of the malicious code intended for download, as the external infrastructure was no longer providing the corresponding file at the time of the investigation.

Therefore, we are currently unable to make a definitive statement regarding the potential impact of the code’s full execution on an endpoint device lacking appropriate security protection.

Modern endpoint security solutions such as EDR or XDR may be able to detect and interrupt such activities at an early stage under certain circumstances. However, whether this occurred on a specific device must be verified by reviewing the respective security logs.

If you have followed the Windows instructions provided, we therefore recommend, regardless of the above, that you have the device undergo a technical inspection.

What measures has LPKF taken?

After the incident came to light, the website was placed in maintenance mode as a precautionary measure, and a technical investigation was initiated.

Together with our IT security service providers and the website operator, measures to contain, remediate, and secure the system were implemented or initiated.

The affected web pages were restored to a state prior to the detected compromise, security-checked, and protected against the identified attack vector via a security update.

In addition, further security measures are being implemented. The causes and potential impacts of the incident are still under investigation.

Is personal data affected?

We are currently investigating whether personal data could have been accessed, altered, or transmitted in connection with the compromise.

As soon as we have further reliable findings on this matter and if these result in additional measures for those affected, we will provide the necessary information. At this time, there is no reason to believe that personal data has been compromised.

Contact

If, in connection with a visit to our website between 3:30 p.m. on September 26, 2026, and 11:00 a.m. on September 28, 2026, you saw a suspicious security or CAPTCHA prompt and followed the Windows instructions contained therein, please contact your IT department or IT service provider.