Ikea launches "full-scale investigation" into email-based cyber attack

IKEA sign on a wall with cloudy sky in background
(Image credit: Shutterstock)

Global furniture giant Ikea confirmed it is wrestling with a cyber attack on its systems with evidence indicating its Microsoft Exchange servers may be compromised.

Ikea confirmed to IT Pro that a "full-scale investigation" into the incident is underway and that there is no indication that customer data has been compromised.

Other Ikea organisations, suppliers, and business partners are all said to be affected by the attack, an internal email sent to employees reads.

The email, seen by Bleeping Computer, informs staff that malicious emails are being circulated around the business and are appearing as a genuine reply to existing email chain.

Email chain hijacking is one of the unique identifiers of the recent SquirrelWaffle malspam campaign that exploits an unpatched vulnerability in Microsoft Exchange servers to distribute the Qakbot malware payload.

Emails can seemingly come from trusted colleagues or outside companies a staff member has previously collaborated with, increasing the likelihood the attempt of a social engineering-led cyber attack succeeds.

"We are aware of the situation regarding the phishing attack against parts of the Ikea organisation," an Ikea spokesperson told IT Pro. "Actions have been taken to prevent damages and a full-scale investigation is ongoing to seal and solve the issue. We take the matter very seriously as safeguarding personal data is a primary concern for Ikea.

"It is of our highest priority that Ikea customers, co-workers and business partners feel certain that their data is secured and handled correctly," they added. "To ensure this, we use security technology to encrypt all personal information, including card numbers, addresses, and other information.

"We have no indication that customer data has been compromised."

Ikea is encouraging staff to remain extra vigilant when monitoring their inboxes for phishing emails, specifically for emails that contain links that have seven numbers at the end.

These links are believed to be associated with the attacker's campaign and lead to the download of a malicious Microsoft Excel document. As is typical with the SquirrelWaffle attack strategy, the document encourages victims to click 'enable editing' and 'enable content' buttons within the document which then leads to the download of the malicious payload.


Protecting every edge to make hackers’ jobs harder, not yours

How to support and secure hybrid architectures


Ikea is also reportedly telling staff to report suspicious emails immediately to its IT team and inform it of the sender's email address over Microsoft Teams instant chat.

The degree to which Ikea staff have been compromised, or how successful the attack has been, is not yet known.

The company has disabled all employees' ability to release suspected phishing emails from quarantine due to how convincing the hijacked email chain method of attack can be.

Ikea reportedly said its email filters are seeing some degree of success in catching the phishing emails, but couldn't take the risk that a staffer wouldn't mistakenly release the email from quarantine given the trusted source.

Connor Jones
News and Analysis Editor

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.