Cyberattack forces closure of over 2,000 WineLab stores as Novabev Group battles major IT disruption
A large-scale ransomware attack has disrupted Novabev Group’s operations, shutting down its retail chain and delaying shipments across Russia.
RUSSIA – Russian alcohol producer Novabev Group has confirmed a major cyberattack that disrupted its operations and forced the temporary closure of its WineLab retail chain.
The incident, which occurred on 14 July 2025, was described by the company as an “unprecedented cyberattack – a large-scale, coordinated action carried out by hackers.”
The attack crippled parts of the company’s IT infrastructure, resulting in the shutdown of over 2,000 WineLab liquor stores across Russia for at least three days. Signs posted at WineLab locations cited “technical issues” as the reason for the closure.
The disruption also affected WineLab’s point-of-sale systems and online platforms, leaving customers unable to collect orders or make new purchases.
Novabev Group, which owns popular vodka brands Beluga and Belenkaya, confirmed that a ransom was demanded by the attackers but stated it had refused to negotiate.
“The company maintains a principled position of rejecting any interaction with cybercriminals and refuses to fulfill their demands,” the statement read. While the company said there is no evidence that customer data was compromised, it noted that a thorough investigation is still underway.
No ransomware group has claimed responsibility for the attack, and Novabev has not publicly attributed the incident to any known threat actor. The attackers’ identity remains unknown.
The cyberattack has also disrupted product shipments from Novabev Group, with local retailers reporting delays of at least two days. Customers were unable to pick up online orders, with Novabev offering extended storage periods for delayed deliveries.
Forbes Russia estimated that each day of downtime could cost WineLab between 200 million and 300 million rubles (US$2.6 million to US$3.8 million) in lost revenue.
Cybersecurity analysts told The Outlet that the scale of this attack is rare, particularly in the Russian retail sector.
Novabev stated that its internal IT team is working closely with external cybersecurity specialists to restore services and improve system security.
The company operates five distilleries and the Golubitskoe Estate winery and reported Rbs135.46bn (US$1.72bn) in revenue for 2024, a 16% increase.
However, operating profit fell by 11% to Rbs12.35bn, while net income dropped 43% to Rbs4.58bn, attributed to higher costs and rapid store expansion.
As of June 2025, WineLab had more than 2,100 outlets. Novabev remains a leading producer and importer of alcoholic beverages in Russia, representing global brands such as Torres, Barceló, and Disaronno.
Sign up HERE to receive our email newsletters with the latest news and insights from Africa and around the world, and follow us on our WhatsApp channel for updates.
