Thyssenkrupp Stock Rallies 27% as Cyber Breach and Auto Cuts Barely Dent Investor Confidence

Thyssenkrupp stock climbs 27.45% YTD, shrugging off a cyberattack on its naval unit and automotive division layoffs as investors focus on portfolio overhaul.

Thyssenkrupp’s shares have charged ahead this year, shrugging off a ransomware attack on one of its naval subsidiaries and the lingering fallout from job cuts in its automotive division. The stock closed on Friday at €11.82, up 27.45% since the start of 2026, and sits just 10.76% below its 52-week high of €13.24 set on October 9, 2025 — a gap that suggests traders are betting the conglomerate’s broader transformation story outweighs isolated operational headaches.

The cyber-incident surfaced on July 18, when a group calling itself “The Gentlemen” listed Thyssenkrupp Marine Systems on its darknet leak site, claiming to have stolen more than a terabyte of data. The company confirmed a security breach but pushed back hard on the scale, saying it hit only a North American subsidiary of Atlas Elektronik, a TKMS division that supplies the U.S. military. Thyssenkrupp stressed that the compromised IT environment was isolated from the corporate network and that no sensitive military data is believed to have been exposed.

The attackers tried to back up their boasts two weeks earlier, releasing screenshots on July 13 that appeared to show classified engineering drawings: a confidential design of a side-scan sonar system from Marine Sonic Technology, and operating manuals for the SeaFox I and SeaFox T underwater minesweeping vehicles built by Atlas Elektronik. While basic specs of those systems are public, the full manuals are tightly controlled internally. Still, no forensics team or government agency has confirmed the group’s claim of a one-terabyte haul, and the group’s past track record includes naming victims whose alleged data breaches could never be independently verified.

“The Gentlemen” itself is a relative newcomer, formed in mid-2025 as a splinter of the notorious Qilin gang. It lured affiliates with an unusually generous 90% profit share and by mid-2026 had rocketed to the top of the most-active ransomware ranking, according to ReliaQuest’s second-quarter analysis. GuidePoint Security’s own Q2 report puts Qilin first and “The Gentlemen” second, but all researchers agree the group is among the most prolific in the current threat landscape.

Thyssenkrupp shares barely flinched at the news. The stock had already gained 6.97% in the past month alone, and the cyber breach failed to knock it off its upward trajectory. That resilience partly reflects the market’s focus on the group’s portfolio overhaul, including plans to spin off or separately list various divisions — a theme that has generated steady re-rating momentum.

Meanwhile, a very different kind of pressure continues to weigh on the automotive body solutions unit. In spring 2025, Thyssenkrupp Automotive Body Solutions announced it would cut up to 230 jobs, roughly a quarter of the workforce, across four German sites: Heilbronn, Weinsberg, Leingarten and Mühlacker. Mühlacker, with about 180 employees, was the hardest hit; the plant produces parts for the Porsche Taycan, and waning demand for the electric sports car has hammered its order book. The IG Metall union slammed the company’s perceived lack of transparency at the time, and the announcement followed an earlier plant closure that displaced around 300 workers.

More than a year on, the structural problems in the auto supply unit remain unresolved. The case illustrates how Thyssenkrupp’s exposure to specific vehicle models — especially ones with concentrated production — can cause immediate pain when sales flag. No updated employment figures for the four sites have been released, and the division’s underlying challenges are seen as persistent.

For investors, the contrast is stark. The conglomerate’s stock is riding a wave of optimism tied to its broader restructuring and the potential value unlock from its marine, materials and industrial units. But the auto business and the cybersecurity vulnerability at Atlas Elektronik both serve as reminders that operational risks can surface with little warning — even as the share price keeps climbing.