SAP Faces Twin Headwinds: A Supply Chain Attack and a Bruised Share Price

SAP faces a double blow: a sophisticated hack on its npm packages and a cautious outlook, sending shares near a 52-week low despite strong cloud growth.

The German software giant is navigating a turbulent period, with a sophisticated cyber assault on its developer ecosystem compounding the market’s already sour mood. While SAP’s cloud business continues to hum, the stock has been battered by a cautious outlook, and a fresh security incident is adding a new layer of risk for investors.

Hackers Breach the Developer Pipeline

On 29 April, attackers compromised widely used npm packages belonging to SAP. The group, identified as “TeamPCP,” injected malicious scripts into core components of the company’s infrastructure, including the Cloud Application Programming Model and the Cloud MTA Build Tool. These packages are fundamental to the developer toolkit, making the breach particularly dangerous.

Once installed, the malware automatically scanned developers’ machines, harvesting credentials, security keys, and tokens. The stolen data was then encrypted and posted on GitHub under the title “A Mini Shai-Hulud has Appeared.” SAP acted swiftly, removing the compromised packages from the network. The immediate consequence for customers is a mandatory review of their systems and a full password reset.

The attack underscores a growing industry vulnerability: supply chain infiltration via open-source software. A single successful breach can grant attackers broad access to corporate networks. The market has yet to price in this risk, as trading was suspended on 1 May due to a public holiday. The last official closing price for SAP shares stood at €145.16. When trading resumes, investors will be assessing the potential financial and reputational fallout.

Cloud Strength, But a Bleak Market View

The security scare arrives at a delicate moment for the stock. Despite a robust first quarter, where cloud ERP Suite revenue surged 30 percent on a currency-adjusted basis and operating profit climbed 17 percent, the share price has been in freefall. The stock currently trades around €144, having lost nearly 29 percent of its value since the start of the year. It is now hovering dangerously close to its 52-week low of €139.12.

Management’s cautious tone has been the primary drag. The company flagged that several one-off factors boosted first-quarter growth and warned of a slower second quarter. A €408 million cash outflow tied to a settlement with Teradata further weighed on sentiment. SAP has reaffirmed its full-year 2026 guidance, but the market remains unconvinced.

A €10 Billion Share Buyback Provides a Floor

The only significant buffer against the selloff is a massive share repurchase program. SAP completed the first tranche in April, buying back €2.6 billion worth of stock. The total program is valued at €10 billion, offering a tangible support level for the shares. However, the divergence in analyst targets reveals deep uncertainty. Goldman Sachs has a buy rating with a €230 price target, while Barclays is overweight at €220. JPMorgan sits neutral at €175, and the DZ Bank has a sell rating with a target of just €130.

Key Events on the Horizon

The next few weeks will be pivotal. On 5 May 2026, SAP holds its virtual annual general meeting, where René Obermann is expected to join the supervisory board, with a view to becoming chairman in 2027. Mid-May brings the Sapphire conference in Orlando, where the company is likely to detail its go-to-market strategy for new AI solutions and the transition to consumption-based pricing models. Meanwhile, the planned acquisition of Reltio is expected to close this year, aimed at bolstering SAP’s AI platform.

For now, the stock is caught between a strong operational core and a series of external shocks. The cyberattack adds a fresh element of uncertainty, and the market’s reaction on the next trading day will be closely watched.