WineLab, Russia’s largest alcohol retail chain and a subsidiary of Novabev Group, has been forced to suspend operations and temporarily close more than 2,000 stores nationwide following a large-scale ransomware attack that severely disrupted its IT infrastructure.
The cyberattack, which occurred on July 14, compromised the company’s critical systems, including point-of-sale terminals, logistics, and online order management, effectively halting operations both in-store and online. As a result, WineLab was unable to process purchases, manage deliveries, or fulfill customer orders for at least three consecutive days.
According to preliminary estimates, the company suffered daily financial losses ranging from 200 to 300 million rubles (approximately $2.6 million to $3.8 million USD) due to the shutdown.
In a public statement, Novabev Group confirmed that it has refused to pay any ransom to the attackers and is working with external cybersecurity experts and law enforcement to investigate the incident and restore operations. As of now, there is no evidence that customer data was compromised, although the investigation is still ongoing.
“This was a highly sophisticated cyberattack that targeted the heart of our retail infrastructure,” said a Novabev spokesperson. “While the disruption has been significant, we are approaching resolution with the help of cybersecurity experts and remain committed to protecting our customers and resuming full operations as quickly as possible.”
The company has not disclosed details about the ransomware group responsible for the attack, and no major ransomware groups have publicly claimed involvement as of July 18.
The WineLab incident represents one of the most serious ransomware attacks to date on Russia’s retail sector. Experts say it underscores the growing threat to critical consumer infrastructure, and highlights how even well-established companies can fall victim to increasingly advanced cyber threats.
Operations across WineLab locations are gradually resuming as systems are restored. Customers are encouraged to check the WineLab website and social media channels for updates regarding local store openings and resumed services.
