Supermarket chain Coop closes 800 stores following Kaseya ransomware attack | Hacker News Reader

Supermarket chain Coop closes 800 stores following Kaseya ransomware attack

therecord.media

38 pointsprostoalex16 comments

14 hours ago

"Temporarily closes". The title without a timeframe implies permanent closure.

Totally. The article definitely caught my attention for that reason. The difference between those two scenarios is an order of magnitude.

No problem /s, the CEO of Kaseya says:

"I am proud to report that our team had a plan in place to jump into action and executed that plan perfectly today. We’ve heard from the vast majority of our customers that they experienced no issues at all, and I am grateful to our internal teams, outside experts, and industry partners who worked alongside of us to quickly bring this to a successful outcome.

Today’s actions are a testament to Kaseya’s unwavering commitment to put our customers first and provide the highest level of support for our products."

In bad taste, directed at shareholders, or misinformed?

"I am dismayed to announce that our team had a plan in place to jump into action and executed that plan only after gaslighting early reports, and skimming end-user incident response findings via twitter DMs after we rolled out of bed today. We’ve heard from the vast majority of our customers that they pulled the plug on our MSP product, and I am grateful that we're still in business, and scrambling for help and bitcoin, but luckily we contract with other B2b IT management outfits who sold this botched stuff on to yet someone else allowing us to skip most of the blame.

Today’s actions are a testament to Kaseya’s unwavering commitment to hope for the best and try to mop up this PR nightmare!"

God speed, Fred Voccola. I see that the "rapid growth phase" has reached its apogee.

https://www.kaseya.com/press-release/kaseya-names-new-ceo-fr...

This explains the sign outside of my local Coop saying they were closed due to IT issues. I imagined it was a catastrophic scenario either from a ransomware or some really bad roll out.

Kaseya is yet again a IT remote management door with full control over devices. Looks like almost all recent ransomware attacks started with exploiting such software to take control of an organization widely...

When will such remote management software be finally considered for the huge risk and attack surface they are?

Coop gives an update on their homepage. It does not sound especially optimistic. They write that shopping online is open, and that stores in a few specific regions are open, and that they "hope to open more stores as soon as possible".

(Swedish:https://www.coop.se/Globala-sidor/stangda-butiker/)

It is hard to imagine what this means for their supply chain and groceries currently in warehouses and on order. If they cannot open at least on Monday, what will happen? Will their compatitors be able to swallow the demand? The need of groceries will stay they same. The size of this problem is not to underestimate. Coop has approximately 20% market share in Sweden.

At one place the main competitor sourced stock from the Coop store due to sudden extra demand. (source swedish: https://sverigesradio.se/artikel/ica-handlare-i-lysekil-hamt... )

This is why you keep redundancy around powered by pen and paper rather than electricity. If nothing else at least keep physical records.

That's Sweden, its highly illegal to do trades while disconnected from the Nanny [State].

Downvoters aren't realizing what cash registers required to report every sale to the tax authority even for groceries

> That's Sweden, its highly illegal to do trades while disconnected from the Nanny [State].

This sort of implies that cash registers must be connected online to the tax authority or some governmental function in order to operate. That is simply not true.

No, but you need to have a cash register approved by the tax authority. The cash register used by Coop the part of the system that was attacked. Coop could switch to a different approved cash register system, but that's presumably a fairly large project.

Wonder how you would go about fixing that. If you didn't want to pay. Just wipe everything/start new from backups?

It takes months for a large org just to prepare for a disaster recovery test. Wiping everything clean for a chain of this size is likey unthinkable. It's probably cheaper to just pay, resume operations and patch afterwards.

Reply on news.ycombinator.com