SAP’s Security Scare Adds to a Bruising Year as Cloud Strength Fails to Lift the Stock

SAP faces a perfect storm: a 27% stock slide, a sophisticated open-source cyberattack, and mixed analyst ratings, despite 19% cloud revenue growth and a €22B backlog.

The contrast between SAP’s operational performance and its stock price has rarely been starker. While the software giant’s cloud business continues to deliver double-digit growth, its shares have been in a relentless slide, shedding over 27% since the start of the year. Now, a sophisticated cyberattack on the company’s open-source ecosystem threatens to deepen the gloom just as management prepares to face shareholders.

Security researchers uncovered malicious code in late April on GitHub, the Microsoft-owned platform widely used by developers. Dubbed “Mini Shai Hulud,” the malware targets SAP’s open-source repositories, with four official SAP packages compromised. The attack is particularly insidious: the malicious script downloads the Bun runtime environment to evade standard security checks before executing its payload. Once inside a system, it steals passwords and access keys for major cloud services and developer platforms.

What makes this strain of malware notable is its geographical selectivity. The code checks the language settings of the infected machine — if it detects Russian system values, it immediately terminates itself. At the same time, it uses stolen credentials to spread autonomously, infecting additional packages across the developer ecosystem without human intervention.

The timing could hardly be worse for SAP. The stock closed near €146.50, perilously close to its 52-week low of €139.12. Goldman Sachs recently trimmed its price target from €260 to €230, though analyst Mohammed Moawalla maintains a “Buy” rating, citing the company’s robust order backlog in an uncertain environment. The analyst consensus, however, is deeply divided: Barclays rates the stock “Overweight” with a €220 target, JPMorgan is “Neutral” at €175, and the DZ Bank has a “Sell” recommendation with a €130 target.

The first-quarter numbers tell a story of operational resilience that the market has chosen to ignore. Cloud revenue climbed 19% year-on-year, with the flagship cloud ERP suite growing 23%. On a currency-adjusted basis, the cloud business expanded 27%. Operating profit rose 17%, and the cloud order backlog now stands at nearly €22 billion. Management is sticking to its full-year forecast of around €26 billion in cloud revenue.

A €408 million legal settlement with Teradata weighed on the bottom line, but the broader narrative remains one of solid execution. JPMorgan’s Toby Ogg described the latest quarterly report as reassuring, though he cautioned that full-year group growth is likely to plateau at last year’s levels.

The company is fighting back on multiple fronts. A multi-billion-euro share buyback programme, running through 2027, recently completed its first €2.6 billion tranche. The next few weeks bring two major catalysts: the annual general meeting in Walldorf on 5 May, followed by the Sapphire conference in Orlando, where CEO Christian Klein will lay out the product strategy.

For the stock to break out of its funk, a move above the 50-day moving average of €156.85 would provide a much-needed technical boost. But with a security breach now in play and analyst opinions ranging from bullish to bearish, the path to recovery looks anything but straightforward.