Goodwill Network Disrupted, 18 Stores Go Cash-Only

Goodwill of Greater Grand Rapids has been operating on a cash-only basis since Saturday, March 14, after a cyber attack disrupted a portion of its network environment.

The nonprofit organization announced the incident on Friday, March 27, stating that the attack affected systems used to operate their local retail stores.

"We immediately notified law enforcement and are working with external cybersecurity experts to investigate the situation, understand the scope, and restore systems as quickly and safely possible," Goodwill of Greater Grand Rapids said in a statement.

Stores remain open for business, but the organization does not yet have a confirmed timeline for full resolution.

What Happened

Goodwill of Greater Grand Rapids operates 18 retail stores across a six-county region in Michigan, including Kent, Ionia, Montcalm, Mecosta, Isabella, and a portion of Ottawa County.

While the organization's systems do not store credit card data, the cyber attack has forced them to abandon card transactions until their point-of-sale program can be rebuilt.

"Our stores continue to be open for business, and we expect to continue cash-only transactions for the next several days," the statement read.

The organization thanks customers and community partners for their patience and support during this challenging time.

Individual Goodwill Systems Not Impacted

Goodwill organizations operate as local nonprofits with separate systems, meaning this incident has no impact on Goodwill stores or organizations in other communities nationwide.

Cybersecurity Expert Analysis

Cybersecurity expert Dr. David Utzke said the ongoing issues with accessing the systems could be a sign of a ransomware attack.

"A ransomware attack is basically where, traditionally, the cyber attacker holds a system hostage until a ransom is paid, and then you may or may not be successful in regaining access to whatever it is that's been locked up," Utzke said.

Utzke does not have internal knowledge of the global cybersecurity issue at Goodwill, but has decades of global cybersecurity knowledge.

The expert believes this attack is a remote access attack, or RAT attack, carried out by a financially motivated group.

"By infiltrating the system and obtaining data about people that have access to their system, people that they have in their system, they can use that as a secondary attack," Utzke said. "And you can basically data mine that information and find out well, these might be our best financially well-off targets and go after them in a phishing attack, which really becomes a Spearfish attack, because now you're targeting people."

Goodwill's Mission Remains Intact

Goodwill of Greater Grand Rapids is a 501(c)(3) nonprofit organization dedicated to changing lives and communities through the power of work.

The organization's comprehensive job training and placement programs assist individuals with disabilities and other employment barriers, utilizing store sales and donations to promote community growth and sustainability.

The cyber attack has not impacted Goodwill's other services, including job training and support for people with disabilities.

Contact Information

Goodwill of Greater Grand Rapids can be reached at:

• Phone: 616.532.4200
• Address: 3035 Prairie Street SW, Grandville, MI 49418

The organization maintains an employment center at 3777 Sparks Dr SE, Grand Rapids, MI 49548.

What This Means for Shoppers

Goodwill stores across Kent, Ionia, Montcalm, Mecosta, Isabella, Osceola, Clare, Gladwin, and a portion of Ottawa counties remain open but will only accept cash until their network is restored.

The organization expects the cash-only situation to last several days, though they do not yet have a confirmed timeline for when full payment processing will resume.

"We wish to thank our customers and community partners for their patience and support while we work through this issue," Goodwill said.