Cyber attack on Metro AG or just a IT break down? Austria, France, German (and more countries?) affected

Sicherheit (Pexels, allgemeine Nutzung)[German]Gastronomy wholesaler Metro group is facing currently serious computer issues in it's stores – I guess world wide. First the question raised: Was there a cyber attack on the Metro Group in Austria? At least that's what the information I have suggests. But Metro says it's not known and talk about a "technical IT issue" with unknown root cause. In any case, for the past few hours, employees in Metro stores have been struggling with severe IT problems and have been unable to issue invoices, etc. Here is some information, what I know so far.


I had already seen a photo on Twitter 2 days ago, showing a handwritten German message in front of a Metro store, claiming that Metro had suffered a cyber attack and business operations in the store were restricted.

Notifying customers about a cyber attac on Metro

But I couldn't quote the message fully, as the handwriting was difficult to read and there was no further information at all. A few hours ago, German blog reader Markus H. contacted me by mail (thanks for that) and wrote:

Hello Mr. Born,

I just received the following info from a colleague:

Apparently, today at Metro AG (in Austria) it is neither possible to digitally book invoices, nor to issue day passes.

Attached also a photo of the notice in the store. Possibly.

Has any further information been reported to you about this?

Markus H. also sent me the following photo, which probably informs about "temporary technical problems in the IT structure" at a Metro branch. It says that digital communication is impaired.

IT-Störung bei Metro
IT disruption at Metro


The Austrian Kronen-Zeitung reports here about a hacker attack and writes that METRO is puzzling over IT problems. In the stores of the Metro Group, there are since Monday, October 17, 2022, probably repeatedly disruptions of the IT systems. It is said that card payments do not work and email communication is disrupted. A METRO Austria spokeswoman, when asked if it was a hacker attack that was responsible for the disruptions, was quoted by the Kronen-Zeitung as saying:

We can't deny that, but we can't confirm it either. Because at the moment we are still looking for the error ourselves.

It is rumored that the company will have fixed the problems by "the end of the week". The Salzburger Nachrichten, another Austrian media, also reports a "possible hacker attack", because Metro Austria is struggling with IT problems. The following tweet points to the Salzburger Nachrichten article, but it is behind a paywall.

IT-Probleme bei Metro Österreich

The Salzburger Nachrichten article says that when a customer wanted to make her purchase at the Metro food wholesaler in Wals-Siezenheim on Wednesday afternoon (20.10.2022), she, like many other customers, was turned away at the entrance door by two ladies. According to the Salzburger Nachrichten, they told her that the store had been hacked. It could take another two weeks until Metro reopens. The medium quotes Metro spokeswoman Alexa Kazda-Klabouch as saying:

We can neither confirm nor deny a hacker attack. The fact is, we are struggling with IT problems. The ATMs fail again and again and the printing of invoices takes longer.

The colleagues of the French SUD OUEST are a bit more precise – Ransomwaremap has thankfully linked in the following tweet to this article.

Cyber-Attack on Metro

It clearly states that the Metro Group has been the victim of a cyberattack and that business operations have been disrupted. A computer failure due to a cyber attack on Monday, October 17, has since caused quite a mess at Metro Group, the main food supplier to restaurateurs. The article says that Metro customers were quite disappointed standing outside stores on Monday because the computer orders they had placed had simply disappeared.

The French headquarters of the German wholesaler Metro is itself hardly able to provide information. On Tuesday, October 18, the latter was contacted by "Sud Ouest" and stated that "all departments are currently unavailable."  On the German Metro website, I have not been able to find any information about a cyber attack or IT disruptions at the time of writing this article. On Twitter, a French user sent me a statement from a French manager and commented in several tweets.

Metro group IT issues

In a comment to Sud Ouest, a ComCorp manager had indicated that it was just a "simple computer problem affecting only some of the branches." So just a technical glitch or something bigger? The communication strategy is not very clever – it's Thursday, the problems have been there since last Monday. The Austrian Broadcasting Corporation (ORF) published this (German] online article from the Salzburg studio on October 20, 2022, but it also only reports "technical difficulties".

German blog reader commented to my German article, reporting also IT problems in German Metro stores. An anonymous reader wrote: This is an international issue, which is the case for all countries where Metro is present, which is still not solved.

The Metro AG

Metro AG is a publicly traded group of wholesale companies. Headquartered in Düsseldorf, Germany, the group employs more than 95,000 people in 681 stores worldwide, most of them in Germany. In Germany, the company primarily operates the Metro wholesale stores. Sales are 24.8 billion euros (2020).

Similar articles:
Cyber attack on Metro AG or just a IT break down? Austria, France, German (and more countries?) affected
Confirmed: Metro Group victim of cyber attack
IT issues at wholesale retailer Metro group after cyber attack: Will shelves in Metro stores soon remain empty?

Cookies helps to fund this blog: Cookie settings


This entry was posted in General, issue, Security and tagged , , . Bookmark the permalink.

2 Responses to Cyber attack on Metro AG or just a IT break down? Austria, France, German (and more countries?) affected

  1. Petr says:

    in Czech Republic told me about the attack my sales representative this Monday 17. 10.

    • guenni says:

      Thanks – I haven't had the time yet to write the English blog post – the cyber attack is just confirmed – see my German blog post from today.

      Addendum: See my added text at the article's end. It points to the English article.

Leave a Reply

Your email address will not be published. Required fields are marked *