IKEA franchise operator Fourlis Group reports €20 Million loss from 2024 ransomware attack

The Fourlis Group, which operates IKEA franchises across Greece, Cyprus, Romania, and Bulgaria, is reporting a significant financial impact from a ransomware attack that occurred just before Black Friday in 2024. The cyberattack affected IKEA's e-commerce platforms and store operations, causing disruptions that lasted from late November 2024 through February 2025.

On December 3, 2024, the company acknowledged that technical difficulties affecting IKEA's online platforms resulted from what they described as a "malicious external action." Fourlis Group also manages other retail brands including Intersport, Foot Locker, and Holland & Barrett and they reported that the IKEA division suffered the most severe impact from the attack.

According to CEO Dimitris Valachis, the financial losses totaled approximately €20 million, with €15 million incurred by December 2024 and an additional €5 million extending into early 2025. Valachis confirmed that no ransom was paid to the attackers, and the company instead relied on external cybersecurity professionals to recover systems and strengthen their defenses.

The company reported that multiple follow-up attacks were detected and successfully blocked following the initial breach. A forensic investigation concluded that there was no evidence of data theft or leakage, though as a precautionary measure, the group notified relevant data protection authorities in all four affected countries in compliance with legal obligations.

"The temporary unavailability of some data was addressed quickly, and there has been no confirmation of any personal data being compromised," the company stated in their official announcement.

As of the reporting date, no ransomware group has claimed responsibility for the attack. Cybersecurity experts suggest this could indicate either that the threat actors failed to exfiltrate data or that they may still be attempting to negotiate privately with the company.