James Pascoe Group cyberattack disrupts New Zealand retail operations
Learn More
James Pascoe Group, one of New Zealand's retail conglomerates, is reporting a cyber-attack over the weekend that disrupted operations across its store network, affecting major brands including Whitcoulls and Farmers.
The cyber-attack impacted various IT systems throughout the retail group's operations, including:
- store telephone lines,
- customer service email channels,
- other critical IT infrastructure.
While stores remained operational during the incident, staff at locations such as Farmers' Albany store were informing customers that electronic payment systems were down without providing specific reasons for the outage.
The company claims its security systems detected the breach quickly, allowing them to minimize potential damage. As of the latest update, most systems have been restored, though the company continues to investigate the incident.
No information has been disclosed about the nature of the attack, the number of affected individuals, or the financial impact of the incident.
Regarding customer data exposure, limited information has been provided:
- A Farmers Club customer service representative claims that credit card information was not compromised, stating "Farmers do not hold your credit card details in the system"
- The same representative stated "there is no evidence to suggest your personal data has been compromised"
The James Pascoe Group's communication regarding the incident is limited:
- When contacted by the New Zealand Herald, a spokeswoman declined to forward their media statement and responded with "no comment" when asked about communications personnel
- No information about the cyber-attack was posted on any of the websites for companies within the James Pascoe Group
- Farmers Card users reported receiving no direct communication about the breach incident
- The company released a brief statement to BusinessDesk acknowledging the attack and system restoration efforts
The incident is concerning because of
- Limited transparency in communications with customers and media
- Absence of details regarding the attack vector, extent of the breach, and comprehensive assessment of data exposure
- Unclear alignment with New Zealand's Privacy Act 2020 notification requirements
