Loading signal...
Signal
Submitted
Nov 2, 2026, 09:22 UTC
Ransomware-style cyberattack on an IT subcontractor forced Coop Sweden to shut about 800 supermarkets across Sweden after checkout systems failed.
On the evening of Friday 2 July 2021 (local time), a cyberattack against an unnamed IT subcontractor disrupted checkout systems for Coop Sweden, one of Sweden’s largest supermarket chains. By Saturday 3 July, Coop Sweden stated it had temporarily closed around 800 stores nationwide because the attack blocked access to its checkouts. The company, which accounts for about 20% of Sweden’s grocery sector and operates as a cooperative, said in a public statement that a "digital attack" on one of its subcontractors meant its checkouts were no longer working, and it would do all it could to reopen swiftly. Coop did not identify the subcontractor or specify the exact hacking method. The incident occurred amid a broader wave of global ransomware attacks, including a large campaign affecting customers of US IT company Kaseya’s VSA remote management platform, and followed a series of ransomware incidents against oil pipelines, health services and major firms that had recently been discussed in a June 2021 meeting between US President Joe Biden and Russian President Vladimir Putin. The article explains that ransomware attacks typically encrypt victims’ data so that companies must pay to regain access, and cites security firm Emsisoft’s estimate that hackers extorted at least $18 billion from such attacks in the previous year.
Confidence: High
Report clearly describes a disruptive cyberattack causing mass closure of supermarkets, fitting Cyber & Information Warfare. The lead is the hostile incident itself, so it is coded as HYBRID_SIGNAL with the attacker as aggressor. Domain is cyberspace and impact is on commercial/critical services, which is consistent with hybrid-warfare style ransomware activity.
Source URL
https://voanews.com/a/europe_major-swedish-supermarket-chain-hit-cyberattack/6207796.html
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "5dacdf6f-cb98-4fea-bb2d-c9021ed48828",
"url": "https://voanews.com/a/europe_major-swedish-supermarket-chain-hit-cyberattack/6207796.html",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Sweden",
"source_reliability": "B",
"info_credibility": "1",
"tags": [
"Coop Sweden",
"Swedish retail sector",
"ransomware",
"cyberattacks",
"IT subcontractor compromise",
"Kaseya VSA",
"Nordic critical infrastructure",
"checkout systems outage",
"Biden-Putin cyber discussions",
"Emsisoft ransomware estimates"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "On the evening of Friday 2 July 2021 (local time), a cyberattack against an unnamed IT subcontractor disrupted checkout systems for Coop Sweden, one of Sweden’s largest supermarket chains. By Saturday 3 July, Coop Sweden stated it had temporarily closed around 800 stores nationwide because the attack blocked access to its checkouts. The company, which accounts for about 20% of Sweden’s grocery sector and operates as a cooperative, said in a public statement that a \"digital attack\" on one of its subcontractors meant its checkouts were no longer working, and it would do all it could to reopen swiftly. Coop did not identify the subcontractor or specify the exact hacking method. The incident occurred amid a broader wave of global ransomware attacks, including a large campaign affecting customers of US IT company Kaseya’s VSA remote management platform, and followed a series of ransomware incidents against oil pipelines, health services and major firms that had recently been discussed in a June 2021 meeting between US President Joe Biden and Russian President Vladimir Putin. The article explains that ransomware attacks typically encrypt victims’ data so that companies must pay to regain access, and cites security firm Emsisoft’s estimate that hackers extorted at least $18 billion from such attacks in the previous year.",
"summary_short": "Ransomware-style cyberattack on an IT subcontractor forced Coop Sweden to shut about 800 supermarkets across Sweden after checkout systems failed.",
"summary_extended": null,
"actor_primary": "Coop Sweden",
"target_primary": null,
"location_text": "Coop Sweden supermarkets, Sweden",
"location_region": null,
"location_coordinates_lat": 60.128161,
"location_coordinates_lon": 18.643501,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "Report clearly describes a disruptive cyberattack causing mass closure of supermarkets, fitting Cyber & Information Warfare. The lead is the hostile incident itself, so it is coded as HYBRID_SIGNAL with the attacker as aggressor. Domain is cyberspace and impact is on commercial/critical services, which is consistent with hybrid-warfare style ransomware activity.",
"event_time_utc": "2021-07-02T16:00:00.000Z",
"end_time_utc": "2021-07-02T21:59:00.000Z",
"event_time_confidence": "pm6h",
"created_at": "2026-11-02T09:22:00.642Z",
"updated_at": "2026-11-08T13:57:32.613Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_6h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
1
Event time
Jul 2, 2021, 16:00 UTC
End time
Jul 2, 2021, 21:59 UTC
Event time confidence
pm6h
Location
Coop Sweden supermarkets, Sweden
Primary actor
Coop Sweden
Country
Sweden
Tags
Coop Sweden, Swedish retail sector, ransomware, cyberattacks, IT subcontractor compromise, Kaseya VSA, Nordic critical infrastructure, checkout systems outage, Biden-Putin cyber discussions, Emsisoft ransomware estimates
Signal
Submitted
Nov 2, 2026, 09:22 UTC
Ransomware-style cyberattack on an IT subcontractor forced Coop Sweden to shut about 800 supermarkets across Sweden after checkout systems failed.
On the evening of Friday 2 July 2021 (local time), a cyberattack against an unnamed IT subcontractor disrupted checkout systems for Coop Sweden, one of Sweden’s largest supermarket chains. By Saturday 3 July, Coop Sweden stated it had temporarily closed around 800 stores nationwide because the attack blocked access to its checkouts. The company, which accounts for about 20% of Sweden’s grocery sector and operates as a cooperative, said in a public statement that a "digital attack" on one of its subcontractors meant its checkouts were no longer working, and it would do all it could to reopen swiftly. Coop did not identify the subcontractor or specify the exact hacking method. The incident occurred amid a broader wave of global ransomware attacks, including a large campaign affecting customers of US IT company Kaseya’s VSA remote management platform, and followed a series of ransomware incidents against oil pipelines, health services and major firms that had recently been discussed in a June 2021 meeting between US President Joe Biden and Russian President Vladimir Putin. The article explains that ransomware attacks typically encrypt victims’ data so that companies must pay to regain access, and cites security firm Emsisoft’s estimate that hackers extorted at least $18 billion from such attacks in the previous year.
Confidence: High
Report clearly describes a disruptive cyberattack causing mass closure of supermarkets, fitting Cyber & Information Warfare. The lead is the hostile incident itself, so it is coded as HYBRID_SIGNAL with the attacker as aggressor. Domain is cyberspace and impact is on commercial/critical services, which is consistent with hybrid-warfare style ransomware activity.
Source URL
https://voanews.com/a/europe_major-swedish-supermarket-chain-hit-cyberattack/6207796.html
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "5dacdf6f-cb98-4fea-bb2d-c9021ed48828",
"url": "https://voanews.com/a/europe_major-swedish-supermarket-chain-hit-cyberattack/6207796.html",
"source": "extension",
"status": "processed",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Sweden",
"source_reliability": "B",
"info_credibility": "1",
"tags": [
"Coop Sweden",
"Swedish retail sector",
"ransomware",
"cyberattacks",
"IT subcontractor compromise",
"Kaseya VSA",
"Nordic critical infrastructure",
"checkout systems outage",
"Biden-Putin cyber discussions",
"Emsisoft ransomware estimates"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "On the evening of Friday 2 July 2021 (local time), a cyberattack against an unnamed IT subcontractor disrupted checkout systems for Coop Sweden, one of Sweden’s largest supermarket chains. By Saturday 3 July, Coop Sweden stated it had temporarily closed around 800 stores nationwide because the attack blocked access to its checkouts. The company, which accounts for about 20% of Sweden’s grocery sector and operates as a cooperative, said in a public statement that a \"digital attack\" on one of its subcontractors meant its checkouts were no longer working, and it would do all it could to reopen swiftly. Coop did not identify the subcontractor or specify the exact hacking method. The incident occurred amid a broader wave of global ransomware attacks, including a large campaign affecting customers of US IT company Kaseya’s VSA remote management platform, and followed a series of ransomware incidents against oil pipelines, health services and major firms that had recently been discussed in a June 2021 meeting between US President Joe Biden and Russian President Vladimir Putin. The article explains that ransomware attacks typically encrypt victims’ data so that companies must pay to regain access, and cites security firm Emsisoft’s estimate that hackers extorted at least $18 billion from such attacks in the previous year.",
"summary_short": "Ransomware-style cyberattack on an IT subcontractor forced Coop Sweden to shut about 800 supermarkets across Sweden after checkout systems failed.",
"summary_extended": null,
"actor_primary": "Coop Sweden",
"target_primary": null,
"location_text": "Coop Sweden supermarkets, Sweden",
"location_region": null,
"location_coordinates_lat": 60.128161,
"location_coordinates_lon": 18.643501,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "Report clearly describes a disruptive cyberattack causing mass closure of supermarkets, fitting Cyber & Information Warfare. The lead is the hostile incident itself, so it is coded as HYBRID_SIGNAL with the attacker as aggressor. Domain is cyberspace and impact is on commercial/critical services, which is consistent with hybrid-warfare style ransomware activity.",
"event_time_utc": "2021-07-02T16:00:00.000Z",
"end_time_utc": "2021-07-02T21:59:00.000Z",
"event_time_confidence": "pm6h",
"created_at": "2026-11-02T09:22:00.642Z",
"updated_at": "2026-11-08T13:57:32.613Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_6h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
1
Event time
Jul 2, 2021, 16:00 UTC
End time
Jul 2, 2021, 21:59 UTC
Event time confidence
pm6h
Location
Coop Sweden supermarkets, Sweden
Primary actor
Coop Sweden
Country
Sweden
Tags
Coop Sweden, Swedish retail sector, ransomware, cyberattacks, IT subcontractor compromise, Kaseya VSA, Nordic critical infrastructure, checkout systems outage, Biden-Putin cyber discussions, Emsisoft ransomware estimates