Smith & Caughey's crypto-locked by ransomware on the day it announced its closure

Smith & Caughey's, a department store that had traded in central Auckland since 1880, was hit by a ransomware attack on 29 May 2024, the same day its board put a proposal to staff to wind the business up in early 2025 after 144 years, with the loss of around 250 jobs.

Chairman Tony Caughey said the company's server and retail operations systems had been crypto-locked, and described the incident as a live one still under investigation. Both physical stores, on Queen Street and in Newmarket, closed to customers. The retailer's website stayed online and continued taking orders.

The attack also cut the company off from the people it most needed to reach. Caughey told RNZ that the incident restricted its ability to communicate with staff, suppliers and other stakeholders about the closure proposal, so many learned of both developments through the media.

On 2 June the LockBit ransomware group listed Smith & Caughey's on its darknet leak site, claiming to hold finance, HR, accounting, management and IT department data. Cyber Daily reported on 4 June that the countdown to publication was approaching eight hours, and that LockBit published no ransom figure and no sample to substantiate the claim. The stores reopened on Friday 31 May, two days after the closure announcement, with the attack having kept them shut one extra day. On 7 June Caughey said the effects were still being felt, with the point of sale system running on a temporary fix that could not process refunds or exchanges in store and would not accept gift cards.