Cyber Incident Victim: Auchan Retail Russia
Date:
Mar 2022
Location:
Russia
Summary
Anonymous launched DDoS attacks against Auchan Retail Russia's website, causing significant downtime, as part of a broader campaign targeting Western companies continuing operations in Russia. The hacktivist collective aimed to disrupt entities perceived as financially supporting the Russian government during the Ukraine conflict, following prior cyber operations against Nestlé and claims of breaching Russia's Central Bank. The attacks resulted in temporary inaccessibility of the victim's online services, aligning with Anonymous's declared objective to pressure companies withdrawing from the Russian market.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Anonymous launched a series of cyber operations against Western companies maintaining business activities in Russia following the country's invasion of Ukraine in February 2022. On March 24, 2022, the collective's affiliated Twitter account Anonymous TV announced offensive actions targeting corporations continuing operations in Russia, explicitly naming French retail conglomerates Auchan, Leroy Merlin, and Decathlon. The group executed distributed denial-of-service (DDoS) attacks against the Russian websites of these companies, rendering them inaccessible to users. Screenshots accompanying the announcement visually confirmed the disruption by showing error messages when attempting to access the targeted domains. This campaign followed Anonymous' prior hack against Nestlé, where the group leaked 50,000 business customer records after stealing 10GB of emails, passwords, and commercial data, establishing a pattern of targeting companies deemed to be financially supporting Russia through tax payments.
The DDoS attacks caused immediate operational disruption by taking down Auchan's Russian online presence, though the duration of the outage remained unspecified in available reports. Anonymous framed these actions as retaliation against corporations indirectly funding Russia's military operations through continued tax contributions. The incident occurred alongside the collective's separate claim of compromising Russia's Central Bank, where they allegedly exfiltrated 35,000 files with threatened imminent publication. While Nestlé experienced confirmed data theft preceding the retail attacks, available evidence regarding Auchan specifically documented only infrastructure disruption rather than data compromise. The coordinated targeting highlighted Anonymous' strategy of combining infrastructure attacks with psychological operations through social media announcements to amplify impact.