What: Danish department store Magasin du Nord confirmed a ransomware attack that encrypted parts of its IT systems and exposed the names, contact details, addresses and purchase histories of its customers, including all Goodie loyalty club members.

Why it is important: The attack shows that a department store can keep its stores and online shop running while internal systems are encrypted. Recovery from such incidents typically takes months rather than days, and Co-op's chief executive stepped down as the costs of its attack mounted.

Copenhagen department store Magasin du Nord has been hit by ransomware. In an email, the company said unauthorised persons gained access to some of its IT systems a few days ago and made them unavailable by encrypting parts of them. Employees can no longer reach the affected systems.

The attackers accessed customers' names, contact details, addresses and purchase histories, including the data of all customers linked to the Goodie loyalty club. In a message to Goodie members, Magasin warned that the information could make phishing attempts more convincing and urged recipients to treat messages, emails and phone calls critically.

The attack did not block the systems central to running the store or those behind the online shop and website. Magasin reported the personal data leak to the Danish Data Protection Agency and the police, and said it is working with external experts to handle the incident and restore access to its systems. No ransom demand, attacker identity or number of affected customers is given.

IADS Notes: The ransomware attack at Magasin du Nord follows a run of retail incidents in which customer data became the main point of leverage. At Asos, a hacker who impersonated a trusted contact obtained an employee's credentials and reached customers' names and contact details on third-party platforms (Reuters, October 2026). De Bijenkorf warned shoppers of heightened phishing risk after a cyberattack on logistics partner CEVA exposed their names, addresses and contact details, and the incident also delayed orders, returns and refunds (nu.nl, September 2026). The operational cost of such events is considerable: in a survey of senior executives, 81% expected critical systems to be restored within 10 days of an attack, while real-world cases average three to six months, and only 35% regularly run real recovery exercises (Harvard Business Review, October 2026). The leadership consequences are visible at Co-op, whose chief executive is stepping down as the costs and disruption of a major cyber attack mount (Financial Times, March 2026). Regulatory exposure can be larger still: Coupang was fined $409 million after a breach of over 33 million customer records, alongside executive resignations and legal actions (Inside Retail, June 2026).

Magasin du Nord hit by ransomware, customer data leaked