Not part of a guided workflow —
Next best move:Open the platform atlas Atlas
AutoResilienceCommand
Ops clock2026-03-17 14:00ZFirst impactT−22.4h

BMW-targeted concept demonstration. Operational entities, suppliers, parts, inventory, production, financial values and incident conditions are synthetic and do not represent BMW systems, performance or current exposure.

Incident command room

Left: what happened. Center: what depends on it. Right: what must be decided next.

INC-2026-0113 · S1 · responding

Incident summary

S1responding
ReferenceINC-2026-0113
TypeRansomware
Affected entityMeridian Stamping
Sites in scope3 sites
Systems in scopeSYS-01, SYS-02, SYS-03
Detected2026-03-17 08:20Z
Estimated start2026-03-16 21:00Z
Time elapsed6h
Containmentin progress
Supplier recovery est.72h (supplier statement, unverified)
Reporting sourceSupplier notification (VP Operations, phone + letter)
Confidencemedium
CommanderL. Marchetti, Incident Commander

Services unavailable

  • ■Order and release intake (830, 862)
  • ■ASN generation (856)
  • ■Outbound shipping labels
  • ■Invoice transmission (810)

Data-integrity concern open: the supplier has not confirmed whether release and shipment data was altered before encryption.

Chronology

  1. 2026-03-16 21:00Z
    Estimated encryption start at supplier (supplier statement, unverified).
    — Meridian Stamping
  2. 2026-03-17 06:35Z
    997 acknowledgements stop arriving for Meridian trading partner ID.
    — OEM EDI Broker
  3. 2026-03-17 08:12Z
    Supplier notifies OEM of ransomware affecting ERP, EDI and shipping systems.
    — Meridian Stamping
  4. 2026-03-17 08:20Z
    Incident INC-2026-0113 opened, severity S1, commander assigned.
    — L. Marchetti
  5. 2026-03-17 09:05Z
    Meridian B2B tunnel terminated at the concentrator (CHG-88214).
    — A. Fournier
  6. 2026-03-17 09:40Z
    Blast radius traversal run; SC Assembly LN-1/LN-2 and Saltillo LN-4 identified as exposed.
    — AutoResilience Command
  7. 2026-03-17 11:15Z
    Manual EDI processing (BCP-1) activation started; capacity 220 messages/day.
    — S. Bhatt
  8. 2026-03-17 12:30Z
    Alternate source Northbend Castings contacted for qualified stamping.
    — T. Nakamura

Exposure cannot be fully determined. Missing information increases—not decreases—decision risk.

  • ▲Meridian has not confirmed whether shipment and release data was altered before encryption.
  • ▲6 part–line pairs in the traced set have no current inventory record.
  • ▲Belmont Die Casting qualification (ALT-2) is 311 days old and unapproved.
  • ▲SC Assembly build-ahead bank plan (BCP-3) has never been tested.

Blast radius

Supplier1
Supplier sites3
Systems & processes25
Parts10
Lines8
Plants3
Programs4
Confirmed material impactProbable or imminentPossible / evidence gapResponse underwayValidated operationalUnknown / not assessed

Dependency path

Select any node above to see why it is in scope, hop by hop, with the source record, owner and validation state of every link.

Priority actions

Board →
  • Disable Meridian service credentialsT+2h
    A. Fournier · CISO Office · P1 · in progress
  • Confirm affected part numbers at SC Assembly and SaltilloT+3h
    K. Ruiz · Materials · P1 · in progress
  • Preserve evidence and open chain of custodyT+4h
    P. Adeyemi · Security Operations · P2 · approved
  • Validate usable inventory excluding quarantineT+4h
    K. Ruiz · Materials · P1 · proposed
  • Activate manual EDI processing (BCP-1)T+4h
    S. Bhatt · Continuity · P1 · in progress
  • Contact Northbend Castings for alternate supplyT+6h
    T. Nakamura · Procurement · P1 · approved

Decisions & approvals pending

  • Validate usable inventory excluding quarantine
    Proposed from template “Validate available inventory” — awaiting L. Marchetti, Incident Commander
  • Prioritise available inventory to Ridgeline
    Proposed from template “Prioritize available inventory” — awaiting L. Marchetti, Incident Commander
  • Resequence Final Trim 1 to banked bodies
    Proposed from template “Adjust production schedule” — awaiting L. Marchetti, Incident Commander
  • Notify affected customers of delivery risk
    Proposed from template “Notify customers” — awaiting L. Marchetti, Incident Commander
  • Validate a live 856 ASN end to end
    Proposed from template “Validate restored transactions” — awaiting L. Marchetti, Incident Commander
  • Security approval of Meridian environment
    Proposed from template “Conduct security approval” — awaiting L. Marchetti, Incident Commander
  • Decision: authorise expedited freight premium
    Proposed from template “Executive decision” — awaiting L. Marchetti, Incident Commander
  • Decision: authorise reconnection when gates pass
    Proposed from template “Authorize reconnection” — awaiting L. Marchetti, Incident Commander

Evidence gaps

  • Credentials rotated
    All shared service accounts, keys and portal identities rotated on both sides.
  • Malicious persistence addressed
    Evidence that persistence mechanisms were removed and the estate rebuilt or cleaned.
  • Data integrity validated
    Supplier proves order, release and shipment data is complete and unaltered.
  • Critical interface tested
    830, 862 and 856 exchanged successfully in a controlled test window.
  • Business transaction completed
    One real purchase order, release and receipt processed end to end.
  • Production or service test passed
    Received material consumed on line without sequencing or quality exception.
  • Cybersecurity approval recorded
    Named security approver signs off with evidence references.
  • Operational approval recorded
    Named operations approver signs off on continuity exit.
  • Reconnection authorised
    Executive authorisation recorded; tunnel re-enabled under monitoring.
Open recovery gates →

Notifications

  • 09:40Z Blast radius recalculated — 8 lines exposed.
  • 11:15Z BCP-1 manual EDI activation in progress.
  • 12:30Z Northbend Castings contacted for alternate supply.