Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Yes. Garmin’s global service outage in July 2020 was caused by a cyberattack that encrypted some of the company’s systems. Garmin confirmed the attack, while independent reporting identified the ransomware as WastedLocker, malware associated with the cybercrime group known as Evil Corp.
The distinction matters: Garmin did not publicly name WastedLocker, confirm that it paid a ransom, or state that customer data was definitely untouched. It said only that it had no indication customer or payment information had been accessed, lost, or stolen.
As an Amazon Associate I earn from qualifying purchases.
The short version
- Attack began: July 23, 2020.
- Garmin acknowledged it: July 27, 2020.
- Reported ransomware: WastedLocker.
- Services affected: Garmin Connect, Garmin.com, customer support, Garmin Explore, inReach account functions, flyGarmin, Garmin Pilot-related services, Connext and third-party synchronization.
- Customer data: Garmin said it had no indication that customer, payment or other personal information had been accessed, lost or stolen.
- Ransom: A $10 million demand was reported, but Garmin never publicly confirmed the amount paid—or that it paid one.
“Four-day outage” is a reasonable shorthand for the main disruption, although restoration was staged and the exact duration varied by service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What happened to Garmin in July 2020?
Garmin’s systems were attacked on July 23, 2020. The company’s July 27 official statement said that a cyberattack encrypted some of its systems and interrupted its websites, customer support, customer-facing applications and company communications.
#1 Best Overall
- Multisport GPS watch with a large 1.4” display in a resilient 51 mm fiber-reinforced polymer case with a steel bezel and rear cover
- Power Glass solar charging lens uses the sun’s energy for weeks of battery life in smartwatch mode
- Built-in LED flashlight with variable intensities and strobe modes gives you greater awareness while you train at night and provides convenient illumination when you need it
- New hill score feature measures your running strength/endurance during ascents and gauges your progress over time
- New endurance score feature combines training data from all your athletic pursuits to help you better understand how training impacts your overall endurance
Garmin’s statement did not use the name WastedLocker. However, BleepingComputer reported, citing sources close to the response and a Garmin employee, that the malware was WastedLocker. The report also described a matching malware sample and ransom-note evidence. TechCrunch and Ars Technica separately reported the WastedLocker identification from sources familiar with the incident.
The most accurate summary is therefore: Garmin confirmed an encrypting cyberattack; independent reporting identified the ransomware as WastedLocker.
Timeline of the outage
- July 23: Garmin’s systems were attacked and some were encrypted. Online services and internal operations began failing.
- July 23–26: Users reported problems with Garmin Connect and related services. Aviation, mapping, support and account functions were also disrupted.
- July 27: Garmin publicly acknowledged the cyberattack and said restoration work was under way. Services began returning in stages.
- August 1: BleepingComputer reported that Garmin had obtained a working WastedLocker decryptor and was using restoration packages to recover affected systems.
That sequence explains why the outage did not end simply because the initial intrusion had been contained. Garmin reportedly shut down additional computers, remote-access systems and data-center equipment to limit the ransomware’s spread. Rebuilding and checking interconnected infrastructure takes considerably longer than bringing a single website back online.
Which Garmin services were affected?
This was not one uniform failure in which every Garmin product stopped functioning. The effects varied by service, but reported disruptions included:
- Garmin Connect’s website, app synchronization and account services.
- Garmin.com functions.
- Customer-support call centers, email and online chat.
- Garmin Explore.
- inReach activation and billing functions.
- flyGarmin.
- Some Garmin Pilot flight-plan and account-sync functions.
- Aviation-related Connext services.
- Synchronization with services such as Strava.
For watch owners, the practical distinction was important. A compatible Garmin watch could generally continue recording a run, ride or workout locally. The user might not be able to upload that activity, view it in Garmin Connect or synchronize it with another service until Garmin’s backend systems returned.
Rank #2
- Advanced multisport GPS smartwatch for athletes/adventurers features a bright 1.3” AMOLED display with scratch-resistant sapphire lens, durable steel or titanium bezel and a built-in LED flashlight for after-dark visibility
- Power up your body’s performance, endurance and resistance to injury with targeted strength training plans, real-time stamina tracking, sport-specific workouts and a full range of built-in sports apps
- Battery performance: up to 10 days in smartwatch mode; up to 28 hours in GPS mode
- Your training readiness score is based on sleep quality, recovery, training load and HRV status to determine if you’re primed to go hard and reap the rewards (data presented is intended to be a close estimation of metrics tracked)
- For your active lifestyle, a built-in speaker and mic let you make and take phone calls from your wrist when your watch is paired to your smartphone — and you can even use your smartphone’s voice assistant to respond to text messages and more
Garmin said product functionality was not affected apart from access to online services. Contemporaneous coverage also reported that inReach SOS and messaging remained operational, an important exception for users relying on satellite communications.
The aviation impact was more consequential than a temporary fitness-data delay. Reports from the Aircraft Owners and Pilots Association described problems involving Garmin aviation services, including account, database and flight-planning functions. The incident showed how consumer, aviation, support and billing products can depend on overlapping centralized infrastructure.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat Garmin officially confirmed
Garmin’s public statement confirmed that:
- It was the victim of a cyberattack.
- The attack encrypted some systems.
- Websites, customer support, customer-facing applications and communications were interrupted.
- Product functionality was not affected except for access to online services.
- The company had no indication that customer data, Garmin Pay payment information or other personal information had been accessed, lost or stolen.
- Normal operations were expected to return over the following days.
- Garmin did not expect a material effect on its operations or financial results.
Garmin repeated substantially the same position in its Form 8-K and later regulatory filings, including its third-quarter 2020 Form 10-Q.
Was the malware really WastedLocker?
The WastedLocker identification is strongly supported by contemporaneous technical and source-based reporting, but it was not a direct admission by Garmin. BleepingComputer said sources close to Garmin’s incident response and a Garmin employee identified the ransomware, and researchers found a sample that matched the reported attack.
WastedLocker was widely associated with Evil Corp, a Russia-linked cybercrime group that the U.S. Treasury had sanctioned. That attribution should still be stated carefully: WastedLocker was associated with Evil Corp; the public evidence does not establish that a Russian government ordered or directly conducted Garmin’s attack.
Rank #3
- Advanced multisport GPS smartwatch for athletes/adventurers features a 1.4” solar charged display with scratch-resistant sapphire lens, durable titanium bezel and built-in LED flashlight for after-dark visibility
- Battery performance: up to 48 days of battery life in smartwatch mode with solar charging (assumes all-day wear with 3 hours per day outside in 50,000 lux conditions) and up to 149 hours in GPS mode with solar charging (assumes continuous use for entire period in 50,000 lux conditions) — all with an always-on display, so you’re ready to take on the toughest challenges
- Power up your body’s performance, endurance and resistance to injury with targeted strength training plans, real-time stamina tracking, sport-specific workouts and a full range of built-in sports apps
- Your training readiness score is based on sleep quality, recovery, training load and HRV status to determine if you’re primed to go hard and reap the rewards (data presented is intended to be a close estimation of metrics tracked)
- For your active lifestyle, a built-in speaker and mic let you make and take phone calls from your wrist when your watch is paired to your smartphone — and you can even use your smartphone’s voice assistant to respond to text messages and more
The sanctions connection also created a potential legal complication around any ransom transaction. It does not, by itself, prove that Garmin paid a ransom or establish how any payment would have been structured. See the U.S. Treasury’s sanctions announcement for the official context.
Recommended Free Tools
Did Garmin pay the ransom?
Garmin did not publicly confirm that it paid.
BleepingComputer reported that employees said the attackers demanded $10 million. It later reported that Garmin had obtained a decryptor and that the company used a restoration package to recover encrypted systems. Other reporting said Garmin worked with a ransomware-negotiation firm.
Those facts support the possibility that a ransom was paid, but they do not establish the exact payment amount, payer or transaction route. Keep the evidence separated:
| Status | What can be said |
|---|---|
| Confirmed by Garmin | An encrypting cyberattack disrupted its systems and services. |
| Reported | The ransom demand was $10 million. |
| Reported or inferred | Garmin obtained a working decryptor and used it during recovery. |
| Unconfirmed | Whether Garmin paid, how much it paid and who formally made any payment. |
It is therefore inaccurate to write simply, “Garmin paid $10 million.” The defensible wording is that a $10 million demand and a likely ransom-related decryptor acquisition were reported, while Garmin did not confirm the payment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Was customer data stolen?
Garmin said it had no indication that customer data, activity data, payment information or other personal information had been accessed, lost or stolen. That is more limited than an absolute guarantee that no data left the company’s systems.
Rank #4
- Multisport GPS smartwatch with built-in inReach technology for two-way satellite and LTE connectivity (active subscription required; coverage limitations may apply; some jurisdictions regulate or prohibit the use of satellite communication devices)
- Rugged design with a bright 1.4" AMOLED touchscreen display, titanium bezel, scratch-resistant sapphire lens and other premium materials
- In an emergency, inReach satellite technology allows you to trigger an interactive SOS message to the Garmin ResponseSM coordination center for 24/7 assistance (active subscription required; coverage limitations may apply; some jurisdictions regulate or prohibit the use of satellite communication devices)
- LTE network connectivity lets you leave your phone behind; use your watch to exchange messages and make voice calls — plus let friends follow along with LiveTrack location sharing (30-second update rate) and location check-ins with the on-device Garmin Messenger app (active subscription required; coverage limitations may apply)
- inReach technology allows you to send messages and get location check-ins over satellite when taking on an off-grid adventure (active subscription required; coverage limitations may apply; some jurisdictions regulate or prohibit the use of satellite communication devices)
Ransomware can involve different actions:
- Encryption: Files or systems are made unavailable.
- Exfiltration: Data is copied out of the network.
- Double extortion: Attackers both steal data and threaten to publish it.
The public information supports saying that Garmin disclosed encryption and service disruption, but did not disclose evidence of customer-data theft. It does not support converting “no indication” into “no data was stolen.”
Why was the outage so broad?
The reported response suggests that the outage resulted from both the encryption and Garmin’s defensive shutdown. If systems are connected across a corporate network, taking them offline to prevent further spread can affect services that appear unrelated to the original infection.
That helps explain how one incident could affect a fitness watch’s synchronization, an aviation account, customer support, mapping services and billing functions at the same time. It also highlights a basic limitation of connected devices: the hardware can keep collecting data locally while the account, cloud storage and synchronization layer is unavailable.
The recovery process was similarly broader than restoring a public webpage. Garmin had to recover infrastructure, validate services, reopen systems in stages and process accumulated synchronization and support demand. This is why a company can contain an attack quickly yet remain partially unavailable for days.
What the incident teaches Garmin users
- Local recording is not the same as cloud access. A watch may retain an activity even when the app cannot display or synchronize it.
- Keep important aviation information available offline. Pilots should not assume that an account, database or flight-planning service will always be reachable.
- Emergency features need separate verification. During this outage, inReach SOS and messaging were reported as continuing to work, but users should always check the current status and operating requirements for their own device and subscription.
- Centralized services create convenience and concentration risk. One backend incident can affect multiple product categories.
- Recovery can be slower than containment. Rebuilding and testing systems is a separate operational problem from stopping the malware’s spread.
The bottom line
Garmin’s 2020 service meltdown was a real ransomware incident, not merely an unexplained server outage. Garmin confirmed that a cyberattack encrypted systems and disrupted its online operations. Independent reporting identified the ransomware as WastedLocker, which was associated with Evil Corp.
The evidence is less definitive on the ransom. A $10 million demand and Garmin’s acquisition of a decryptor were reported, but Garmin never publicly confirmed that it paid. Likewise, Garmin said it had no indication of customer-data theft; that should not be rewritten as absolute proof that no information was accessed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
