A shopper walks into a supermarket and sees gaps along the shelves. The spaces expose the white backing, with a few packets pushed forward. Nothing appears broken. The lights work and tills are open, and no sign explains the missing stock. This is not a missed delivery or a bad harvest. An intrusion in the retailer’s own systems has interrupted the flow that should carry products from suppliers to depots, from depots to stores, and from stores into shopping baskets.

A cyberattack on a retailer empties shelves long before it empties bank accounts.

Why the Shelf Empties

Retail replenishment is a chain of decisions made by software and people. A store needs to know what sold, what is available in the depot, what a supplier can provide, and when the next order should be released. If those systems go down, the physical stock does not vanish instantly. The process that replaces it does. Orders may not be created, delivery instructions may not be issued, and warehouse teams may lose the screens that tell them what to pick.

That is why an attack first becomes visible as a row of missing essentials. Trucks may exist, suppliers may still have goods, and a depot may still contain stock. But if the retailer cannot access inventory records, process orders, or coordinate deliveries, stock is stranded at the wrong point. Store colleagues can face an empty fixture. The failure is quiet and physical.

In April 2025, three well-known British retailers were hit in the same campaign: a large clothing and food retailer, a member-owned grocery chain, and a luxury department store. The grocery chain could not take contactless card payments in up to 200 stores, while shoppers faced empty shelves across its 2,500 food stores. Its supply to more than 5,100 other stores, including independently run convenience stores and its own wholesale business, was also disrupted.

The Numbers Behind the Empty Aisle

The clothing and food retailer stopped all online clothing and homeware sales for about six weeks. Contactless payments and click and collect failed. It reported empty shelves in stores because its logistics systems were disrupted, not because of demand. One estimate put its daily revenue loss at about 3.8 million pounds. It later disclosed approximately 300 million pounds of lost trading and supply chain disruption, while adjusted pretax profit fell 23.8 percent to 671.4 million pounds for the year to the end of March.

The grocery chain separately reported a 206 million pound revenue loss and, for the six months to July, an underlying operating loss of 32 million pounds. Those figures show how a system failure reaches across checkout lanes, replenishment teams and store networks. A failed payment frustrates a shopper. A failed ordering and distribution process removes the product that shopper came to buy.

Customer data taken in the grocery chain incident included names, dates of birth and contact details of members, but not passwords, financial details, or shopping history. In a later 2026 incident at an online fashion retailer, some customer names and contact details were accessed, while payment card data and account passwords were reported as not compromised. The absence of stolen payment data does not make an empty aisle harmless.

What the Attackers Actually Did

The intrusion pattern was practical rather than theatrical. Attackers impersonated employees and persuaded IT help desks to reset passwords. That gave them a route into accounts that appeared legitimate. In one case, they stole the directory database that holds account credentials, cracked the password hashes, and moved laterally through the network.

Ransomware was then deployed on virtualisation servers that host many of the company’s systems at once. When those servers were disabled, systems supporting orders, stock visibility, warehouse work and store operations could become unavailable together. The attacker did not need to manipulate every shelf. Removing the systems that coordinate replenishment was enough.

The wave continued in 2026, when further British retail brands were affected and other sectors were hit too, including a major car manufacturer whose factory production was suspended. Security experts described the pattern as attackers concentrating on one sector at a time and then moving on. The playbook can be reused against store networks.

Supplier Relationships Are the Hidden Casualty

Suppliers feel the attack when orders stop arriving, forecasts become unreliable, and receiving schedules change without warning. A retailer may be unable to confirm what it needs, when it needs it, or whether an earlier order has been fulfilled. The supplier still has staff, stock and production commitments, but the signal connecting that capacity to the shop floor has gone silent.

The disruption also travels outward through store networks. The grocery chain’s interruption affected more than its directly operated food stores, reaching independently run convenience stores and its own wholesale business. Those outlets rely on predictable supply, and their customers experience the same missing products even though the attack began inside the retailer’s systems. A problem in one ordering environment can become a service failure for many businesses with different owners and tills.

Retail and supply chain professionals should test one specific scenario: if identity systems, virtualisation servers and replenishment tools are unavailable together, which orders, depot movements and store deliveries can still be executed manually, and how will suppliers be told what to send? Ask how long each partner can operate on that fallback, then measure whether the answer is hours, days or not at all.