Spar shops across northern England shut after cyber attack hits payment processing abilities

The British arm of Dutch supermarket chain Spar has shut hundreds of shops after suffering an "online attack," the company has confirmed to The Register.

"This has not affected all SPAR stores across the North of England," a Spar spokesman told us, "but a number have been impacted over the past 24 hours and we are working to resolve this situation as quickly as possible."

LancsLive, a local news website for Lancashire, reported that a "total and widespread IT outage" hit the chain at the weekend, along with "security breach" problems today.

The publication reported that food distie James Hall & Co, which provides services to 600 Spar stores was also down - the company website is serving up only an Error 20 code, indicating a general network failure.

"At James Hall we are currently aware of an online attack on our IT systems. This has affected around 330 SPAR stores across the North of England over the past 24 hours and we are working to resolve this situation as quickly as possible," it told LancsLive.

"It is currently impacting stores’ ability to process card payments meaning that a number of SPAR stores are currently closed to shoppers or only taking cash payments. We apologise for the inconvenience this is causing our customers and we are working as quickly as possible to resolve the situation," the statement added.

It is not yet known whether the incidents are part of a ransomware attack or just a catastrophic IT collapse caused by something else.

Spar has a total of 2,600 shops in the UK and, according to its website, £3bn in annual turnover. Around the world, the Dutch-owned chain has 13,000 shops. Most of these are locally owned franchises, with some being located in independent petrol stations. Closure of these therefore means some petrol stations are shut as well.

An Esso-branded petrol station in Ulverston, Cumbria, was forced to close, with its operators claiming on Facebook that this was Spar's fault:

• Utility biz Delta-Montrose Electric Association loses billing capability and two decades of records after cyber attack
• Wind turbine maker Vestas confirms recent security incident was ransomware
• Google advises passwords are good, spear phishing is bad, and free clouds get attacked
• Apple sues 'amoral 21st century mercenaries' NSO for infecting iPhones with Pegasus spyware

Similarly, Lawrence Hunt & Co Ltd, another Spar franchisee, used Facebook to announce its closure yesterday "due to a total network outage affecting tills, credit cards and back office systems."

Spar is not the only large UK retailer to suffer a recent cyber attack. In October Tesco suffered a two-day outage after unidentified malicious folk made an "attempt to interfere" with its website. A couple of weeks later some pranksters compromised the website of Angling Direct, directing people searching for fishing tackle to websites featuring an altogether different form of tackle.

Furniture Village, another British retailer, was hit by a "cyber attack" in June as well. With such companies processing and storing details on millions of Britons, it's no surprise they're now in the firing line of criminals looking to steal and cause havoc online. ®