James Pascoe Group cyberattack disrupts Farmers and Whitcoulls stores

James Pascoe Group, the New Zealand retail company behind Farmers, Whitcoulls, Pascoes The Jewellers, Stevens and Stewart Dawsons, confirmed on 18 March 2025 that it had been hit by a cyberattack over the preceding weekend.

The intrusion took down store telephone lines, the customer service email channel and other IT systems. Some Farmers stores were reduced to accepting cash only, at least one Whitcoulls branch closed, and customers reported that they could not redeem gift vouchers or reach stores by phone. Staff described the group's back end, including its intranet and phone system, as being down.

In a short statement the company said its security systems detected the attack quickly, that potential damage was minimised, and that most systems had been restored. It declined interview requests and released little further detail. BusinessDesk reported on 26 March 2025 that a message left on the group's computer interfaces, leaked to the publication, told staff their infrastructure had been breached and that all critical data on their virtual servers had been encrypted. The company did not publicly confirm ransomware and no group was named. A Farmers customer service representative told one shopper that credit card details were not held in the affected systems.

James Pascoe Group notified New Zealand's Office of the Privacy Commissioner of a data breach, as the Privacy Act 2020 requires for serious incidents. The commissioner said it could not discuss the nature, cause or scale of the breach while its assessment was under way. Some Farmers Card holders said they had received no direct notification. The group operates more than 650 stores across New Zealand and Australia.