A cyberattack has disrupted operations at Romina Mineralbrunnen GmbH, a mineral water bottler based in Reutlingen-Rommelsbach, forcing the company to halt production for several days. The incident was detected during the night of January 29 to January 30, 2026 after abnormal activity was identified in bottling and cleaning processes and led to a shutdown of IT systems and internal networks. As a precaution, external connections were severed, leaving the company temporarily unreachable by email or fixed-line telephone and prompting the setup of an emergency hotline.
Production was brought to a standstill, while logistics and deliveries initially continued thanks to sufficient stock and the fact that the core warehouse management system remained operational via the parent group Franken Brunnen. However, as inventories were gradually depleted, supply gaps began to emerge. Forensic specialists from the criminal police and external IT experts are investigating the incident, which is believed to involve unauthorized system access and data encryption aimed at extortion. Romina has since been restoring key processes and preparing its bottling and returnable-glass cleaning systems for restart, with full operations expected to resume after extensive hygiene and safety procedures.
The attack adds Romina to a growing list of beverage producers targeted by cybercriminals. In recent years, several breweries and soft drink manufacturers have faced similar incidents, underlining the sector’s increasing exposure. National and international brewing groups such as Japan’s Asahi (inside.beer, 2.10.2025; inside.beer, 27.11.2025), Germany’s Oettinger (inside.beer, 6.5.2025), Belgium’s Duvel Moortgat (inside.beer, 8.3.2024), and Australia’s Lion (inside.beer, 12.6.2020) have previously reported cyber incidents affecting production planning or administrative systems,
These cases show that attackers increasingly focus on manufacturers with high automation levels, where digital disruptions can quickly translate into physical production losses.
Industry observers note that beverage producers, like breweries, are attractive targets due to their continuous operations, complex logistics, and dependence on integrated IT systems. Even when core production data remain intact, outages in communication, billing, or quality control can lead to multi-day shutdowns and lasting market effects.
