Ransomware (extortion): Retail (shop), Sweden 2021
At the beginning of July 2021, REvil distributed ransomware via a fake update of the remote maintenance software Kaseya VSA.
- Incident · 07.2021 · Sweden
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Attack via a supplier
As of
What happened
Because Coop Sweden’s till service provider was affected, tills and self-service checkouts stopped working, and most of the around 800 shops had to close. On 9 July, Coop reported that all shops were operating again.
- Affected
- Coop Sverige (not Coop Switzerland)
- Industry
- Retail (shop)
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Till system service provider Visma EssCom, hit via the remote maintenance software Kaseya VSA
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income if the cloud or a provider is attacked
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
An attack on the IT service provider can close the entire shop through no fault of your own; the risk must be covered in the contract and in the insurance.
Sources
- Supermarket chain Coop closes 800 stores following Kaseya ransomware attack (opens in a new window) The Record · 2021-07-03
- Coop supermarket closes 500 stores after Kaseya ransomware attack (opens in a new window) BleepingComputer · 2021-07