Fourlis Group, the operator of IKEA stores in Greece, Cyprus, Romania, and Bulgaria, disclosed substantial financial losses due to a ransomware attack that occurred just before Black Friday on November 27, 2024. The group announced that the incident resulted in damages estimated at €20 million ($22.8 million).
The security breach became public on December 3, 2024, when Fourlis confirmed that the technical issues affecting IKEA’s online operations were a result of “malicious external action.” This interruption primarily impacted the company’s home furnishings segment and e-commerce functionalities during the critical holiday shopping season spanning December 2024 through February 2025.
CEO Dimitris Valachis provided further insights into the situation, stating that the ransomware attack significantly hindered IKEA’s sales operations, with an estimated impact of €15 million until December 2024, and an additional €5 million anticipated in 2025. Valachis emphasized that the company did not succumb to the demands of the ransomware actors and managed to restore its systems with the assistance of external cybersecurity specialists.
In a positive turn, the Fourlis Group reported successfully defending against multiple subsequent attacks following the initial incident. An investigation into the breach revealed no evidence of data theft or leaks, and as per legal requirements, data protection authorities across the four involved countries were duly notified. Preliminary findings indicated that the temporary unavailability of some data was promptly addressed. The forensic report confirmed that there was no leakage of personal data associated with the attack.
Despite the passage of several months since the attack, no ransomware group has publicly claimed responsibility, suggesting that the attackers either failed to exfiltrate any data or are still seeking a private resolution with the Fourlis Group.