Not part of a guided workflow —
Next best move:Open the platform atlas Atlas
S1 active — INC-2026-0113

Exposure calculation — Meridian Stamping ransomware — ERP and EDI unavailable

Elapsed 5.7h since detectionCommander L. Marchetti, Incident Commander
Demonstration data — synthetic, internally consistent
First production impact expected in
22 hours, 24 minutes

Synthetic SC Assembly, Line SC-2 (final assembly) is projected to stop first because 98R-1225 Door inner panel A inventory will be exhausted before Meridian Stamping is expected to recover.

Plants exposed
3
Lines at imminent risk
4
within 48h
Critical parts affected
10
4 single-sourced
Units at risk
3,662
Financial exposure
$130.2M
Supplier recovery estimate
72h
stated, not evidenced
Inventory window
22.4h
usable stock + confirmed inbound
Recovery confidence
Low
no validated recovery evidence
Decisions required now
3
cyber, production, sourcing
Change one input — supplier recoveryCountdown, units, exposure and all three recommendations recalculate from the stored records — nothing on this screen is a fixed answer.
Left

Operational countdown

  1. Synthetic SC Assembly — Line SC-2 (final assembly)22.4h
    2 parts affectedstoppage 25.6h1,126 units$46.4M
  2. Synthetic Kitchener Assembly — Compact Trim28.2h
    1 parts affectedstoppage 19.8h950 units$26.0M
  3. Synthetic SC Assembly — Line SC-3 (chassis)28.3h
    1 parts affectedstoppage 19.7h1,024 units$28.1M
  4. Synthetic Saltillo Assembly — Frame Line33.2h
    2 parts affectedstoppage 14.8h562 units$29.7M
  5. Synthetic SC Assembly — Line SC-1 (body)52.3h
    2 parts affectedstoppage 0h0 units$0k1 unresolved
  6. Synthetic Kitchener Assembly — Van Body Line59.2h
    2 parts affectedstoppage 0h0 units$0k
  7. Synthetic Saltillo Assembly — Final Trim 271.5h
    2 parts affectedstoppage 0h0 units$0k
  8. Synthetic Saltillo Assembly — Chassis Sub-assembly84.4h
    1 parts affectedstoppage 0h0 units$0k
Centre

Impact pathway — select any link to see why

Meridian Stamping → units and revenue
Why this link is asserted

Reported 2026-03-17T08:20:00.000Z. Containment at the supplier: in_progress.

Source record
Supplier notification (VP Operations, phone + letter)
Data owner
L. Marchetti, Incident Commander
Validation / last updated
2026-03-17T14:00:00.000Z
Classification
Supported estimate

Evidence EV-1: Meridian incident notification letter — supplier statement, provided by Meridian Stamping — VP Operations, validated 2026-03-17T14:00:00.000Z.

Right

Decisions required now

Cyber risk if connection stays active Supported estimate
ransomware at Meridian Stamping, containment in_progress, data integrity in question. 3 of their systems unavailable. — source: Supplier notification (VP Operations, phone + letter)
Operational consequence of isolation Verified fact
10 interfaces stop: 3 have no manual fallback, 2 are tested. Order release and shipment confirmation move to manual handling. — source: Interface register
ERP / EDI transactions affected Verified fact
830 Planning Schedule (EDI, fallback documented); 862 Shipping Schedule (EDI, fallback documented); 856 ASN inbound (EDI, fallback tested); 810 Invoice (EDI, fallback documented) — source: Interface register
Evidence currently available Supported estimate
Supplier tunnel isolation confirmation (validated 2026-03-17T14:00:00.000Z) — source: Evidence register
Consequence of delay

Every hour the connection stays open allows possibly tampered master and order data to propagate into our ERP, which would require rollback rather than reconciliation.

Approvals required
  • Cyber lead approval
  • IT integration approval
Calculation and rule trace
  • Rule: isolate when containment ≠ contained OR data integrity is in question. Containment = in_progress; data integrity concern = yes.
  • Decision window = 2h cyber standard for an uncontained event, independent of the production countdown.
Bottom

Evidence and assumptions

Operator workspaceCalculation methodIncident record
Verified facts
  • Meridian incident notification letter — Meridian Stamping — VP Operations, validated 2026-03-17T14:00:00.000Z
  • EDI 997 acknowledgement gap report — OEM EDI Broker, validated 2026-03-17T14:00:00.000Z
  • SC Assembly on-hand count — critical stampings — SC Assembly WMS, validated 2026-03-17T14:00:00.000Z
  • Saltillo on-hand count — Synthetic Saltillo WMS, validated 2026-03-16T14:00:00.000Z
  • Northbend alternate-source qualification — T. Nakamura, Procurement, validated 2026-01-12T14:00:00.000Z
Supported estimates
  • Meridian Stamping is running a ransomware disruption.
  • Its ERP and EDI and WMS operations are unavailable.
  • Shipment confirmation and release messaging is interrupted.
  • 3,662 units and $130.2M at risk over 48 hours.
Working assumptions
  • Supplier recovery of 72h is stated by the supplier only.
  • Safety stock is held back; scrap applied at ×1.
  • Line SC-2 (final assembly) stops when that part runs out.
Unknown, stale or conflicting
  • Meridian has not confirmed whether shipment and release data was altered before encryption.
  • 6 part–line pairs in the traced set have no current inventory record.
  • Belmont Die Casting qualification (ALT-2) is 311 days old and unapproved.
  • SC Assembly build-ahead bank plan (BCP-3) has never been tested.
  • 1 part–line position has no usable inventory or consumption record.
  • Belmont alternate-source qualification — superseded / stale

Exposure cannot be fully determined. Missing information increases—not decreases—decision risk.