Two of Russia’s largest pharmacy chains suspended operations across several regions on Tuesday following cyberattacks that disrupted digital infrastructure and brought their nationwide networks offline.
The closures at Neopharm and Stolichki have impacted over 1,100 pharmacy locations in more than 80 cities across central Russia since they began, leaving customers unable to access prescriptions and medication reservations, loyalty programs or point-of-sale systems.
Stolichki, the larger of the two networks with more than 1,000 locations, operates across Moscow, St. Petersburg and the the Leningrad, Tula and Vladimir regions.
Notices posted to the company’s website apologized for the disruption and promised that “unavailable features would be restored soon.”
Neopharm, which runs over 110 pharmacies in Moscow and St. Petersburg, experienced similar shutdowns. Employees were sent home as IT systems remained nonfunctional.
Initially, the chains cited “technical reasons” for the outages. Stolichki later confirmed that the suspensions were caused by a cyberattack and that restoration efforts were underway.
According to the Telegram news channel Mash, All Stolichki locations in the Moscow area were forced to close entirely, with cash registers and accounting systems taken offline.
Some employees were placed on unpaid leave as the company worked to assess the damage. Sources told the outlet that the outages could last up to two days.
Until mid-2022, both Stolichki and Neopharm were controlled almost entirely by businessman and former State Duma deputy Yevgeny Nifantiev, who transferred his stake to a closed-end mutual investment fund called Zdravinvest after being sanctioned over his support of Russia’s invasion of Ukraine.
Sergei Shulyak, CEO of market research firm DSM Group, said such fund structures can serve as protective mechanisms against secondary sanctions, allowing sanctioned individuals to maintain indirect control over their business interests while providing legal separation from direct ownership.
The pharmacy outages followed closely on the heels of another major cyberattack, this time against flagship airline Aeroflot.
On Monday, Ukrainian hacking group Silent Crow and Belarusian group Cyber Partisans claimed responsibility for destroying 7,000 Aeroflot servers, crippling operations at Moscow’s airports and causing nationwide disruptions.
Russia’s Prosecutor General’s Office confirmed that Aeroflot’s system failures stemmed from unauthorized access.
The Cyber Partisans later claimed the airline’s systems still ran on the outdated Windows XP platform and that CEO Sergei Aleksandrovsky had not updated his password since 2022.
A Message from The Moscow Times:
Dear readers,
We are facing unprecedented challenges. Russia's Prosecutor General's Office has designated The Moscow Times as an "undesirable" organization, criminalizing our work and putting our staff at risk of prosecution. This follows our earlier unjust labeling as a "foreign agent."
These actions are direct attempts to silence independent journalism in Russia. The authorities claim our work "discredits the decisions of the Russian leadership." We see things differently: we strive to provide accurate, unbiased reporting on Russia.
We, the journalists of The Moscow Times, refuse to be silenced. But to continue our work, we need your help.
Your support, no matter how small, makes a world of difference. If you can, please support us monthly starting from just $2. It's quick to set up, and every contribution makes a significant impact.
By supporting The Moscow Times, you're defending open, independent journalism in the face of repression. Thank you for standing with us.
Remind me later.
