Industrial software maker AVEVA says someone got unauthorized access to its corporate SharePoint, the internal document repository its staff use to store and share files. The company posted the notice as security bulletin AVEVA-2026-007 on its Cyber Security Updates page, and Red Tiger Security reported on it on Oct. 23, 2026.
AVEVA, a Schneider Electric business, makes software used in plant control rooms and operations, including the PI System, System Platform, InTouch and Plant SCADA. That's why this matters well beyond AVEVA's own office: its software runs in oil and gas, power, water, chemicals and manufacturing operations, and in the integrator shops that set those systems up.
What AVEVA has confirmed, and what it hasn't
Confirmed by AVEVA:
- What was accessed: AVEVA is "investigating unauthorized access to its corporate SharePoint, an internal document repository."
- What wasn't affected, so far: "As things stand, there is no impact on AVEVA's software or production environments, which are separate." The bulletin is headed "This update does not affect AVEVA software and platforms."
- Response: AVEVA has activated an incident response plan, brought in outside cybersecurity experts and notified law enforcement.
- No product fix needed: There are no vulnerability details, and AVEVA says "no specific defensive measures are recommended at this time."
- What comes next: If the investigation "identifies any material impact on third parties, further notifications will be issued as soon as possible."
Not confirmed: AVEVA hasn't said how the intruder got in, when it happened, what files were in the repository, or whether any customer or partner files were taken. It hasn't described ransomware, encryption, or any outage. On Oct. 20, a newly seen extortion group calling itself Mimori listed AVEVA on its leak site and claimed 177,234 files, with a publication date of Oct. 23, according to leak-site trackers Ransomware.live and CTIWatch as reported by CyPro. That is an unverified claim: AVEVA's bulletin doesn't mention Mimori, no sample files have been shown publicly, and Ransomware.live itself says the claim "should be treated with caution until independently verified." We haven't seen any confirmation that files were published.
Why it matters to manufacturers and plant operators
Most small manufacturers will never be the company in the headline. They're the customer whose files sit in a vendor's folders. Over the years, support cases and projects with an industrial software vendor or integrator tend to collect things you'd never post publicly: network diagrams, configuration exports, screenshots of HMI screens, site contact lists, and sometimes a password typed into a support ticket "just this once."
If those files ever leak, two risks follow. The first is a map: an attacker learns how your plant network is laid out and which remote access tools you use. The second is phishing that sounds real. An email that quotes your actual support case number or project name, asking you to install an "urgent patch" or log in to "confirm your license," is far more convincing than a generic scam. AVEVA hasn't said any customer files were involved, so treat this as a reason to do a check-up, not a reason to panic.
Clear takeaway
If your plant uses AVEVA software, there's nothing to patch because of this bulletin. Do make a list of what your team has shared with AVEVA or any OT vendor, change any password or remote access secret that was ever sent to a vendor, and verify every unexpected "patch" or login request by phone before acting on it.
Actions to take this week
- Inventory what you've shared. Ask your engineers and your integrator what has gone to AVEVA or other OT vendors through support tickets, shared folders and email: diagrams, configuration backups, contact lists, credentials.
- Rotate anything that was ever sent. Change any password, service account or VPN/remote access secret that was shared with a vendor, even years ago. Assume anything typed into a ticket is no longer secret.
- Tighten vendor remote access. Give each vendor its own named account with MFA, turn it on only when there's a scheduled job, and turn it off afterward. Review remote access logs for vendor accounts used outside those windows.
- Install software only from the source. Download updates from the vendor's official portal, not from an emailed link or attachment. Tell engineers and purchasing that AVEVA has said no defensive action is needed for its products right now, so an "urgent AVEVA patch" email is a red flag.
- Call back on anything unusual. Verify unexpected vendor requests, invoices, license renewals or bank-detail changes with a known contact at a number you already have.
- Watch for updates. Bookmark AVEVA's Cyber Security Updates page and ask your account rep to tell you directly if the investigation finds customer files were involved.
- Keep your own copies. Make sure your current configurations and project files are backed up on your side, offline, so you're never relying on a vendor's folder to rebuild.
Brotherly Technology helps manufacturers, production shops and industrial offices across Rome, Northwest Georgia, Atlanta, Chattanooga and the Southeast lock down vendor access and clean up the passwords that end up scattered across support tickets. If you'd like a quick review of who can reach your plant network and what you've shared with vendors, give us a call.
Sources:
- AVEVA Cyber Security Updates: Security Bulletin AVEVA-2026-007, "Corporate SharePoint Not AVEVA Software - Unauthorized Access Issue" (checked Oct. 25, 2026). Source for all company-confirmed facts and quotes.
- Red Tiger Security: "AVEVA Investigating Unauthorized Access to Corporate SharePoint; Software Unaffected" (Oct. 23, 2026). Source for the product list and the timing of the bulletin.
- CyPro: "AVEVA Ransomware Claim by Mimori Unconfirmed". Source for the Mimori leak-site claim and tracker details (unverified).
- Ransomware.live: Aveva (Mimori) listing. Leak-site tracker entry, labeled by the tracker as an emerging group whose claim should be treated with caution.