Source: SVT Nyheter
Swedish furniture manufacturer Kinnarps has halted production at three of its factories after a cyberattack discovered on the evening of Saturday 7 November 2026. The company, which is headquartered in Kinnarp south of Falkoping and supplies furniture for offices and public environments across roughly 40 countries, shut down its systems and servers immediately after finding abnormal activity in its network. From Monday 9 November, the production lines stood still at its plants in Kinnarp, Jonkoping and Skillingaryd, and the company website was also taken offline, with visitors referred to the switchboard.
By Wednesday 11 November, the fourth day, the stoppage was still in place and around 920 employees could not work, according to a published report. About 650 people work at the Kinnarp facility alone. The group employs around 1,700 people overall and turned over SEK 4.0 billion in its 2024/2025 financial year.
What the company has said
“When we discovered the data intrusion we acted immediately and shut down our systems to isolate and minimise the damage,” Ann Cederwall, Director Global Marketing and Communications at Kinnarps, told SVT. She said the IT department, together with external experts, had worked around the clock, had traced fairly quickly where the attackers got in, and that the company had filed a police report. No ransom demand has been made, and nobody has claimed responsibility. The company has not disclosed the entry point, whether files were encrypted or copied, or whether personal data is involved. On 10 November the stated hope was to have production running fully again later that week.
Why the regulatory angle matters less than you think
There is a detail in this story that every mid-sized European manufacturer should notice. Sweden’s cybersecurity law implementing the NIS2 directive limits its manufacturing sector to medical devices, electronics, electrical equipment, machinery and vehicles. Furniture manufacturing sits outside that list, so an attack that idles 920 people at a SEK 4 billion group triggers no 24-hour early warning to the national CSIRT. The only confirmed report so far is the one to the police, and any GDPR notification clock depends on whether personal data turns out to be involved. In other words, the regulation will not force anyone to be ready for this. Readiness has to come from the company itself.
The real lesson for European manufacturers
A factory floor in 2026 depends on IT systems for everything from production planning to delivery route scheduling, and Kinnarps says 24 fully loaded containers normally leave its factories every day. When those systems go dark, the option to keep producing by hand simply does not exist. The companies that recover fastest are the ones that prepared before the intrusion: segmented networks that make containment a decision rather than a guess, tested offline procedures for order handling and logistics, backups that are unreachable from the production network, and an incident response plan that has actually been rehearsed rather than filed away. Kinnarps reacted quickly and decisively, which likely limited the damage, but four days of stopped lines show how much production resilience depends on preparation.
If your production depends on systems that have never been stress-tested against an attacker, contact Excello Digital and let us review your network segmentation, backup strategy and incident response readiness before an intrusion does the test for you.