Federated Co-operatives cyberattack disrupted Co-op stores and fuel cardlocks

Federated Co-operatives Limited, the Saskatoon-based wholesaler that supplies retail Co-op stores across Western Canada, said on June 27, 2024 that it was responding to a cybersecurity incident affecting internal and customer-facing systems. The company shut down parts of its network as a precaution and brought in third-party experts to investigate.

The disruption spread quickly through the Co-op retail network. Cardlock fuel sites, which serve commercial and agricultural customers around the clock, went offline across the Prairies, and member grocery stores reported empty shelves and shortages of bread, produce, dairy and frozen goods, with in-store signage blaming an unforeseen IT disruption. Federated Co-operatives said all 398 cardlock locations were back in service by early July, but its own website and those of several member co-ops remained down well into the month.

On July 9, 2024, the Akira ransomware group listed Federated Co-operatives on its leak site and claimed to have taken 80 gigabytes of data, including human resources files with employee data, financial records and client information. Federated Co-operatives acknowledged the claim and said it was investigating whether its data had been taken, while repeating that it had no evidence consumer data was compromised and that it would take appropriate action if that changed. The company did not describe the nature of the attack. Natalia Stakhanova, a University of Saskatchewan computer science professor, told the Prince Albert Daily Herald that from the outside it looked likely to be a ransomware attack.

By mid-July 2024 the company said the incident had been contained and that fuel supply was relatively unaffected, though recovery of customer-facing systems was still under way. Federated Co-operatives employs more than 23,000 people and reports annual revenue above 10 billion Canadian dollars.