Kwik Trip confirmed a cyberattack caused its two-week systems outage

Kwik Trip, a convenience store chain with more than 800 locations across six Midwestern states, confirmed on the evening of Thursday, October 19, 2023 that a cyberattack was behind the technology outage that had disrupted its operations since October 9. For most of the preceding two weeks the company had described the problem only as a network incident and declined to say whether an attacker was involved.

The disruption hit systems on the company's internal network rather than store checkout lanes. Affected areas included production facilities in La Crosse, Wisconsin, internal communications such as phone and email, and the Kwik Rewards loyalty program along with its app and website. Reporting during the outage also described problems with inventory counts, printers and payroll.

Kwik Trip said the incident was detected within hours and that mitigation began immediately with help from outside cybersecurity specialists. The company said it had found no indication that customer payment card information was involved, while noting that its forensic review was continuing and could uncover more.

The company never publicly stated whether ransomware was used, and no group claimed the attack. Kwik Rewards was restored and reported fully functional by October 23, 2023. Kwik Trip credited members with bonus visits based on their average weekly visits before the outage and offered double visits on every in-store and at-the-pump purchase through November 5, 2023 to make up for the lost period.