The company Visma Esscom is a supplier to several retail chains in Sweden, including Coop, Apoteket Hjärtat, ST1 and Plantagen.
All use the software Kaseya, but the latter company has not confirmed any disruptions.
- You are affected to varying degrees so it is not obvious that everything stands still just because you have been affected.
Coop seems to be hardest hit by our clients, says Fabian Mogren.
Wants to sabotage and hinder function
The purpose of the cyber attack is not to access personal data or other data according to Fabian Mogren, but to sabotage and hinder the function of the computer or machine where the software is installed.
In some cases, they have been able to establish that a text file has appeared on the desktops of some computers with a ransom requirement.
- This is based on the fact that you are willing to pay to get your computer up and running again.
But what has affected our clients are individual cash register systems that do not contain anything and we are now looking for ways to reinstall the machines, says Fabian Mogren.
"Broadest, most powerful attack"
According to the American news site Bloomberg, it could be an attack from a Russia-based hacker group called REevil.
About 200 companies have been affected, Bloomberg writes.
- This is one of the broadest, most powerful attacks by a non-state actor we have seen and it seems to be designed solely for extortion, says Ander Howard, head of the Swiss company Kudelski Security.
Different consequences and symptoms
For Visma Esscom's, all resources are now being spent on trying to fix the hardware that has been affected.
- We are now struggling to come up with a solution.
It is complicated work because they have been affected in different ways, says Fabian Mogren.
Different computers and cash registers have been affected in different ways and have had different symptoms.
For example, Apotek Hjärtat has been affected to the same extent as Coop, but at the same time is not completely still as Coop's grocery stores do.
- You know the virus with a water balloon that is thrown from the third floor. You do not know exactly how the drops will hit once the balloon hits the ground, says Fabian Mogren.
SVT Nyheter has contacted Kaseya, who refers to a press release.
The expert: "I think we will see more attacks like these in the future"
Javascript is disabled
Javascript must be turned on to play video
Read more about browser support
The browser is not supported
SVT does not support playback in your browser.
We therefore recommend that you switch to another browser.
Read more about browser support
Experts now link the attack on Coop to the software company Kaseya, which is said to have been hacked by a notorious group.
Photo: TT / SVT