What: Magasin du Nord kept all its stores and its webshop open after detecting unauthorised activity in parts of its internal IT systems on 18 October, while it investigates what personal data may have been affected.

Why it is important: Only 5% of Danish companies surveyed say they could largely carry out core activities without central IT. Magasin's ability to trade manually shows the value of a fallback that has been tested in practice.

On Sunday 18 October, Magasin du Nord detected unauthorised activity in parts of its IT systems, affecting a number of internal functions. Its security team, working with relevant authorities, worked to investigate the incident and limit its consequences.

Stores and the webshop stayed open. A few stores experienced startup difficulties on Sunday, with employees handling parts of the work manually, but all stores opened, while cash registers and online shopping kept running. CEO Peter Fabricius credited employees' flexibility and effort.

Magasin is still establishing the full extent of the incident, including which personal data on customers, employees and partners may have been affected. Payment card information was not part of the breach, as it is handled by Magasin's payment provider and not stored in the affected systems. The incident has been reported to the authorities, and affected groups are being informed directly.

A January 2026 survey by the Danish Confederation of Business found only 5% of surveyed member companies could largely carry out core activities without access to central IT systems. The Danish Chamber of Commerce described Magasin's experience as a relevant example for the entire Danish retail trade. Magasin plans to use the lessons in its preparedness work.

IADS Notes: Magasin's ability to keep trading stands in contrast to M&S, where a cyber attack forced a seven-week suspension of online sales and a £136mn profit hit (Financial Times, November 2025). The gap between expectation and reality remains wide: 81% of surveyed executives expect critical systems to be restored within 10 days of an attack, while real-world cases average three to six months, and only 35% of organisations regularly test recovery under real scenarios (Harvard Business Review, October 2026). Retail continues to be targeted at pace. In mid-October, attacks on refrigeration controllers spoiled stock across about 400 French supermarkets as Asos, TFG London and Ahold Delhaize reported separate incidents (The Robin Report, October 2026). Within days, H&M Group began investigating claims of an attack by the group linked to the Asos breach, in which customer names and contact details were accessed but no payment card information (Retail Week, October 2026). As at Magasin, keeping payment data out of the affected systems limited exposure at De Bijenkorf. There, an attack on logistics partner CEVA compromised customer personal data but not bank or card details, though it still delayed orders, returns and refunds (nu.nl, September 2026).

Magasin du Nord keeps stores and webshop open through IT incident