2021-12-27 RR Donnelley & Sons Co Cybersecurity Incident

Page last updated on September 24, 2025

RR Donnelley & Sons Co initially disclosed a cybersecurity incident in an SEC 8-K filing on 2021-12-27 16:19:37 EST.

Incident Details

Material: Unknown
Is Breach: Unknown
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date: Unknown
Detected Date: Unknown
Disclosure Date: 2021-12-27
Contained Date: Unknown
Recovered Date: Unknown

Attack Goal: Unknown
Attack Tactics¹: TA0010, TA0001
Attack Techniques¹: OTHER

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2021-12-27

RR Donnelley & Sons Co filed an 8-K at 2021-12-27 16:19:37 EST
Accession Number: 0001193125-21-367028

Item 8.01 Other Events.

On December 27, 2021, R. R. Donnelley & Sons Company (the "Company"), announced it had recently identified a systems intrusion in its technical environment. The Company promptly implemented a series of containment measures to address this situation, including activating its incident response protocols, shutting down its servers and systems and commencing a forensic investigation. The Company has engaged a cybersecurity expert to examine the incident and to oversee the implementation of appropriate remedial actions. The Company has notified and is working with appropriate law enforcement authorities. As a precautionary measure, the Company has isolated a portion of its technical environment in an effort to contain the intrusion.

The Company is actively engaged in restoring the affected systems and returning to normal levels of operations. At this time, the Company is not aware of any compromise of client data. The Company is in the early stages of its investigation and assessment of the security event and cannot determine at this time the extent of the material adverse impact, if any, from such event on its business, results of operations or financial condition.

8-K filed on 2022-01-13

RR Donnelley & Sons Co filed an 8-K at 2022-01-13 16:13:07 EST
Accession Number: 0001193125-22-008674

Item 8.01 Other Events.

As disclosed on December 27, 2021, R. R. Donnelley & Sons Company (the "Company") identified a systems intrusion in its technical environment. In response, the Company promptly implemented a series of containment measures to address the situation, including activating its incident response protocols, shutting down its servers and systems and commencing a forensic investigation. The Company also engaged a cybersecurity expert to examine the incident and oversee the implementation of appropriate remedial actions. The Company notified and continues to work with appropriate law enforcement authorities. As a precautionary measure, the Company isolated and continues to isolate a portion of its technical environment in an effort to contain the intrusion. The Company has also taken steps to further enhance its security measures safeguarding its information technology environment.

The Company continues to be actively engaged in restoring the affected systems and returning to normal levels of operations, and believes the incident has been contained. At this time, the Company is not aware of any compromise of client data. The Company is keeping clients informed of any relevant updates on an ongoing basis and appreciates its clients' patience and understanding as the systems intrusion continues to be investigated. As the Company's investigation and assessment of this security event is ongoing, the Company cannot determine at this time the extent of the material adverse impact, if any, from the event on its business, results of operations or financial condition.

8-K filed on 2022-01-18

RR Donnelley & Sons Co filed an 8-K at 2022-01-18 08:33:36 EST
Accession Number: 0001193125-22-010648

Item 8.01 Other Events.

As previously disclosed, R. R. Donnelley & Sons Company (the "Company") identified a systems intrusion in its technical environment. In response, the Company promptly implemented a series of containment measures to address the situation, including activating its incident response protocols, shutting down its servers and systems and commencing a forensic investigation. The Company also engaged cybersecurity experts to examine the incident and oversee the implementation of appropriate remedial actions. The Company notified and continues to work with appropriate law enforcement authorities. As a precautionary measure, the Company isolated and continues to isolate a portion of its technical environment in an effort to contain the intrusion. The Company has also taken steps to further enhance its security measures safeguarding its information technology environment and client data.

The Company continues to be actively engaged in restoring the affected systems and returning to normal levels of operations, and believes that the steps taken to isolate and remediate the identified threat have been effective. At this time, however, the Company has become aware that certain of its corporate data was accessed and exfiltrated, the nature of which is being actively examined. Based on information known to date, the Company believes the access and exfiltration was in connection with the previously disclosed systems intrusion and not a new incident. The Company is keeping clients informed of any relevant updates on an ongoing basis and plans to take all appropriate measures to safeguard the integrity of the Company's data and clients' information. As the Company's investigation and assessment of this security event is ongoing, the Company cannot determine at this time the extent of the material adverse impact, if any, from the event on its business, results of operations or financial condition.

Company Information