Cyber Incident Victim: Smith & Caughey’s
Date:
May 2024
Location:
New Zealand
Summary
Smith & Caughey’s, a longstanding Auckland department store, experienced a cyberattack coinciding with its announcement of a proposed permanent closure after 144 years of operation. The incident occurred on the same day the closure plans—which include significant job losses—were made public, though no direct link between the cyber event and the closure decision was specified in available reports. The attack compounded operational challenges faced by the retailer during this transitional period.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 29, 2024, Smith & Caughey’s, a 144-year-old Auckland department store, publicly announced its proposal to cease operations in early 2025. The closure plan coincided with a confirmed cyberattack against the retailer, though the exact timing of the intrusion relative to the closure announcement remained unspecified in public reporting. No technical details regarding the attack vector, malware type, or initial compromise method were disclosed. The company did not release information about data exfiltration, ransomware deployment, or operational disruptions stemming from the incident. The cyberattack represented an additional operational challenge during a period of significant organizational transition, as the proposed closure would result in job losses across its retail workforce.
The simultaneous occurrence of a major business decision and a cybersecurity incident introduced reputational and operational complexities for the historic retailer. Established in 1880, Smith & Caughey’s occupied a prominent position in New Zealand’s retail sector, amplifying public interest in both events. The company’s public communications did not establish a confirmed causal relationship between the cyberattack and the closure decision. No forensic findings, threat actor attribution, or system recovery timelines were published at the time of initial reporting. The incident highlighted cybersecurity risks facing retail organizations during periods of organizational restructuring, though the specific financial or data-related consequences of the attack remained unquantified in available disclosures.