BRP Resumes Operations after Cyberattack

VALCOURT, QUEBEC, CANADA – August 15, 2022 – (Motor Sports NewsWire) – BRP Inc. (TSX: DOO, NASDAQ: DOOO) reports that the Company’s efforts to restore systems and business operations are continuing following the recent cyberattack.

Today, BRP manufacturing sites in Valcourt (Canada), Rovaniemi (Finland), Sturtevant (USA) and Gunskirchen (Austria) are ramping up production activities and expect to be fully operational on August 16, 2022. The rest of the production sites are planning to resume operations over the course of the week in a phased approach.

BRP’s team, with the assistance of external advisors, are currently working to restore all internal systems from its back-up repositories. The Company confirms that the malware infiltration came through a third-party service provider. BRP believes that the impact of the cyberattack was limited to its internal systems.

At this time, while the investigation is still ongoing, it has not revealed any evidence that its clients’ personal information would have been affected by the attack. As such, at this stage, BRP expects that the impact of this incident from a data privacy perspective should be limited. Should the circumstances change, BRP would directly contact individuals or corporations impacted.

“Cybersecurity at BRP is a top priority. We have a strong team of experts committed to taking every appropriate measure to ensure the integrity of systems and data,” said José Boisjoli, President and CEO of BRP. “I thank them for all their efforts to mitigate the consequences of the attack.”

BRP has put in place a recovery plan to minimize the financial consequences of the cyberattack and does not anticipate any impact on its year-end financial guidance.

Caution concerning forward-looking statements

Certain information included in this release, including, but not limited to, statements relating to the resumption of operations at various BRP sites, the timing of such activities, the fact that the impact from this cyberattack was limited to its internal systems, was limited from a data privacy perspective, the Company’s ability to mitigate financial consequences due to this cyberattack, and its lack of impact on its financial-year end guidance and statements about the Company’s current and future business and strategic plans, and other statements that are not historical facts, are “forward-looking statements” within the meaning of Canadian and United States securities laws….