Neopharm

Summary

Cyberattacks disrupted the digital infrastructure of two major Russian pharmacy chains, forcing the suspension of operations at over 1,100 locations across more than eighty cities. Neopharm, which runs over 110 pharmacies in Moscow and St Petersburg, saw its IT systems go offline, sending employees home and halting prescription access, loyalty programs and point‑of‑sale functions. Stolichki, the larger chain with more than 1,000 outlets in Moscow, St Petersburg and the Leningrad, Tula and Vladimir regions, reported that cash registers and accounting systems were taken offline, with some staff placed on unpaid leave while restoration efforts proceeded. Initially attributed to technical issues, the outages were later confirmed as a cyberattack. The incidents followed a separate attack on a national airline that was claimed by Ukrainian and Belarusian hacking groups, which destroyed thousands of servers and crippled airport operations, with investigators citing unauthorized access and outdated software.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Tuesday, July 29, 2025, Neopharm and Stolichki suspended operations across several regions following a cyberattack that disrupted digital infrastructure and brought their nationwide networks offline. The closures affected over 1,100 pharmacy locations in more than 80 cities across central Russia. Neopharm, which operates over 110 pharmacies in Moscow and St. Petersburg, experienced similar shutdowns, with its IT systems becoming nonfunctional. Employees were sent home as the systems remained unavailable. Initially both chains attributed the outages to technical reasons before Stolichki later confirmed that a cyberattack was the cause and that restoration efforts were underway.

The outage left customers unable to access prescriptions, medication reservations, loyalty programs, or point-of-sale systems at the affected locations. According to the Telegram news channel Mash, all Stolichki locations in the Moscow area were forced to close entirely, with cash registers and accounting systems taken offline; Neopharm’s stores in the same cities were also affected by the shutdowns. Some employees at both chains were placed on unpaid leave while the companies assessed the damage, and sources indicated that the outages could persist for up to two days as IT teams worked to restore services. No further details about the specific malware or attack vector were disclosed in the reporting.

Prior to mid‑2022, both Neopharm and Stolichki were controlled almost entirely by businessman and former State Duma deputy Yevgeny Nifantiev, who transferred his stake to a closed‑end mutual investment fund called Zdravinvest after being sanctioned for his support of Russia’s invasion of Ukraine. The pharmacy incidents occurred shortly after a separate cyberattack on Aeroflot, in which Ukrainian hacking group Silent Crow and Belarusian group Cyber Partisans claimed responsibility for destroying 7,000 servers, though no linkage between the two events was established in the sources.

Sources

Sources available to members: 1 source.