Goodwill Stores Hit by Cyberattack, Switch to Cash-Only Operations Across Six-County Region

GRAND RAPIDS, Mich. — Goodwill of Greater Grand Rapids has been forced to operate on a cash-only basis after a cyberattack disrupted the network systems running 18 stores across Kent, Ionia, Montcalm, Mecosta, Isabella, and portions of Ottawa County.

On Friday, March 27, officials from Goodwill of Greater Grand Rapids announced they "recently" were the subject of a cyberattack that disrupted "a portion of (their) network environment," resulting in their point-of-sale systems going offline while they work with law enforcement to understand the scope and restore everything.

"Our stores continue to be open for business, and we expect to continue cash-only transactions for the next several days," officials said in a statement released Friday afternoon. "We wish to thank our customers and community partners for their patience and support while we work through this issue."

Investigation Underway with Law Enforcement

The investigation is ongoing with no confirmed timeline for full resolution. Goodwill staff are working with external cybersecurity experts and local police agencies to investigate the incident and rebuild their point-of-sale program.

Earlier reports referred to the attack as ransomware, but Goodwill officials have since revised their language to simply call it a cyberattack. The organization is currently rebuilding its point-of-sales system, a common indicator of a ransomware-style attack where attackers hold systems hostage until a ransom is paid.

"A ransomware attack is basically where, traditionally, the cyber attacker holds a system hostage until a ransom is paid, and then you may or may not be successful at regaining access to whatever it is that they've locked up," said Dr. David Utzke, a cybersecurity expert with decades of global cybersecurity knowledge.

Utzke, who does not have internal knowledge of Goodwill's situation, believes the attack may be a remote access attack carried out by a financially motivated group. He noted that attackers often infiltrate systems to gather information about people who have access, then use that data for secondary attacks.

"By infiltrating the system and obtaining data about people that have access their system, people that they have in their system, they can use that as a secondary attack," Utzke said. "And you can basically data mine that information and find out well, you know, these might be our best financially, well off targets and go after them in a phishing attack, which really becomes a Spearfish attack, because now you're targeting people."

Goodwill Does Not Store Credit Card Data

Despite the cash-only restrictions, Goodwill of Greater Grand Rapids officials confirmed the organization does not store credit card information on their systems. The switch to cash-only is purely due to their point-of-sale program being down, not a security concern about card data.

"We do not store credit card data and have been operating on a cash-only basis while we rebuild our point-of-sale program," Goodwill officials stated.

18 Stores Across Six Counties Affected

Goodwill of Greater Grand Rapids operates stores across six counties including Kent, Ionia, Montcalm, Mecosta, Isabella, and a portion of Ottawa County. The organization runs 18 retail locations and an online shopping site.

Because individual Goodwill stores operate on separate systems, the attack has no impact on stores in other communities outside their 18 Grand Rapids area stores. Other Goodwill organizations in Michigan and nationwide are not affected by this incident.

Core Services Remain Operational

While the retail stores have been impacted, Goodwill's core mission services remain operational. The nonprofit's job training programs, support services for people with disabilities, and employment assistance are not affected by the network disruption.

"Goodwill's other services, including job training and support for people with disabilities, were not impacted by the attack, the company said."

Community Partners Express Support

The organization has asked customers and community partners for patience during this challenging time. Goodwill has been serving the Greater Grand Rapids community for decades, providing employment opportunities, job training, and support services to thousands of individuals.

The nonprofit operates from its main office at 3035 Prairie Street SW in Grandville, with an employment center located at 3777 Sparks Dr SE in Grand Rapids.

What Customers Should Know

• Stores are still open for business
• Cash-only transactions will continue for the next several days
• No credit or debit card processing at this time
• Core services including job training remain operational
• Investigation ongoing with no confirmed timeline for full resolution

Goodwill organizations operate independently, and this incident is limited to the 18 stores in the Greater Grand Rapids region. Other communities' Goodwill organizations continue to operate normally with full card processing capabilities.

About Goodwill Industries of Greater Grand Rapids

Goodwill Industries of Greater Grand Rapids is a 501(c)(3) nonprofit organization dedicated to changing lives and communities through the power of work. Operating across a six-county region in Michigan, the organization runs 18 retail stores and an online shopping site, providing comprehensive job training and placement programs that assist individuals with disabilities and other employment barriers.

Stay Updated

Goodwill of Greater Grand Rapids will continue to monitor the situation and update customers and community partners as more information becomes available. The organization remains committed to serving its community during this challenging time.

Sources

• https://wwmt.com/news/local/cyberattack-goodwill-greater-grand-rapids-offline-cash-only-network-investigation-data-point-sale-kent-county-western-michigan
• https://www.wzzm13.com/article/news/local/goodwill-of-greater-grand-rapids-ransomware-attack/69-5c4fe062-7a57-41cc-baaf-32256ab87ec6
• https://www.fox17online.com/news/local-news/grand-rapids/some-goodwill-stores-in-west-michigan-impacted-by-cyberattack
• https://www.goodwillgr.org/news/cyberincident/