The ransomware attack that shut 800 supermarkets in Sweden

In July 2021, Swedish grocery chain Coop closed around 800 stores. Their checkout tills stopped working after ransomware spread through Kaseya, IT management software used by one of the chain's suppliers.

Why one supplier took down a whole chain

Criminals abused trusted IT software to push ransomware to many businesses at once. Coop was not the target — it was simply downstream. Fresh and frozen stock waited in stores that could not sell a thing.

The human lesson

• Your security is only as strong as the people at every supplier.
• Ransomware usually starts with one stolen login or one bad click.
• Staff need a plan for when systems go dark — not just IT.

In 2025, UK retailer Marks & Spencer paused online orders for weeks after attackers reportedly talked their way past help-desk checks. Different method, same root: people under pressure.

What to do this week

• Ask key suppliers how they train their staff.
• Make help desks verify callers through a second channel.
• Write a one-page 'systems are down' plan for store and office staff.