Cyber Incident Victim: SPAR
Date:
Dec 2021
Location:
United Kingdom
Summary
A cyberattack disrupted operations at approximately 330 stores in northern England affiliated with the SPAR supermarket franchise, forcing widespread closures and cash-only transactions due to compromised IT systems. The incident caused a total IT outage affecting payment processing, tills, and email access, with no immediate restoration timeline provided. While unconfirmed officially, the disruption displayed characteristics consistent with ransomware. The UK's National Cybersecurity Center acknowledged the incident and assisted in evaluating its impact.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around December 4-5, 2021, a cyberattack disrupted operations at approximately 330 SPAR convenience stores across northern England. The incident caused a widespread IT outage affecting critical systems, including point-of-sale terminals and credit card processing capabilities. Lawrence Hunt & Co Ltd., operating 25 SPAR branches in Lancashire, reported a "total IT outage" that began impacting stores on Sunday, December 5, forcing immediate closures and preventing email access. James Hall and Co, the Preston-based distributor serving 600 SPAR locations in the region, confirmed the cyberattack's impact on their systems, which cascaded to retail operations. Stores experienced immediate payment processing failures, with many unable to accept card transactions.
By December 6, numerous SPAR locations remained closed or operated under cash-only restrictions due to unresolved technical issues. SPAR Ribchester and other affected stores provided no estimated restoration timeline for their systems. The UK's National Cyber Security Centre (NCSC) acknowledged the incident and initiated evaluations, though no official attribution or specific attack methodology was disclosed at the time. Operational disruptions included prolonged store closures, loss of electronic payment capabilities, and communication system inaccessibility. Retail operators publicly apologized for customer inconveniences while working to restore services, with no confirmed resolution timeframe available as of the reporting date. The incident's scope remained confined to SPAR's northern England operations, without impacting the organization's international network of 13,320 stores across 48 countries.