IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Ikea launches "full-scale investigation" into email-based cyber attack

Early evidence seems to indicate a compromise of Microsoft Exchange servers in a reply chain attack campaign

Global furniture giant Ikea confirmed it is wrestling with a cyber attack on its systems with evidence indicating its Microsoft Exchange servers may be compromised.

Ikea confirmed to IT Pro that a "full-scale investigation" into the incident is underway and that there is no indication that customer data has been compromised. 

Other Ikea organisations, suppliers, and business partners are all said to be affected by the attack, an internal email sent to employees reads.

The email, seen by Bleeping Computer, informs staff that malicious emails are being circulated around the business and are appearing as a genuine reply to existing email chain.

Email chain hijacking is one of the unique identifiers of the recent SquirrelWaffle malspam campaign that exploits an unpatched vulnerability in Microsoft Exchange servers to distribute the Qakbot malware payload.

Emails can seemingly come from trusted colleagues or outside companies a staff member has previously collaborated with, increasing the likelihood the attempt of a social engineering-led cyber attack succeeds.

"We are aware of the situation regarding the phishing attack against parts of the Ikea organisation," an Ikea spokesperson told IT Pro. "Actions have been taken to prevent damages and a full-scale investigation is ongoing to seal and solve the issue. We take the matter very seriously as safeguarding personal data is a primary concern for Ikea. 

"It is of our highest priority that Ikea customers, co-workers and business partners feel certain that their data is secured and handled correctly," they added. "To ensure this, we use security technology to encrypt all personal information, including card numbers, addresses, and other information.

"We have no indication that customer data has been compromised."

Ikea is encouraging staff to remain extra vigilant when monitoring their inboxes for phishing emails, specifically for emails that contain links that have seven numbers at the end.

These links are believed to be associated with the attacker's campaign and lead to the download of a malicious Microsoft Excel document. As is typical with the SquirrelWaffle attack strategy, the document encourages victims to click 'enable editing' and 'enable content' buttons within the document which then leads to the download of the malicious payload.

Related Resource

Protecting every edge to make hackers’ jobs harder, not yours

How to support and secure hybrid architectures

White square with whitepaper title on top of a background image of a building and pavementFree download

Ikea is also reportedly telling staff to report suspicious emails immediately to its IT team and inform it of the sender's email address over Microsoft Teams instant chat.

The degree to which Ikea staff have been compromised, or how successful the attack has been, is not yet known. 

The company has disabled all employees' ability to release suspected phishing emails from quarantine due to how convincing the hijacked email chain method of attack can be.

Ikea reportedly said its email filters are seeing some degree of success in catching the phishing emails, but couldn't take the risk that a staffer wouldn't mistakenly release the email from quarantine given the trusted source.

Featured Resources

Accelerating healthcare transformation through patient-centred medtech solutions

Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes

Free Download

Big payoffs from big bets in AI-powered automation

Automation disruptors realise 1.5 x higher revenue growth

Free Download

Hyperscaler cloud service providers top ten

Why it's important for companies to consider hyperscaler cloud service providers, and why they matter

Free Download

Strategic app modernisation drives digital transformation

Address business needs both now and in the future

Free Download

Most Popular

Empowering employees to truly work anywhere

Empowering employees to truly work anywhere

22 Nov 2022
Salesforce co-CEO Bret Taylor resigns with cryptic parting message
Business operations

Salesforce co-CEO Bret Taylor resigns with cryptic parting message

1 Dec 2022
Netherlands urges citizens to prepare survival kits in case hackers target critical infrastructure
cyber attacks

Netherlands urges citizens to prepare survival kits in case hackers target critical infrastructure

2 Dec 2022