Wildberries is where millions of Russians buy socks, frying pans and nappies. It is also, according to reporting, where you can buy drone components and body armour. Same catalogue, same checkout, same payment infrastructure that Ukraine’s military intelligence now says it knocked out, working with the Cyber Corps hacker group, while drones were hitting the company’s warehouses.
The claim itself is standard wartime material. HUR, Ukraine’s military intelligence directorate, says customer service, contact centres and payment processing were disrupted, and that numerous complaints came in from customers who could not pay. No independent verification. No comment from the company. An intelligence agency announcing its own success is not an incident report; it is a press release with better branding, and anyone reading it as forensic evidence deserves whatever they end up believing.
So treat it as what it is, one side’s account, and then look at the scenario that account describes. Ukraine’s Defence Ministry claims seven of the company’s ten largest logistics centres have been knocked out of operation. On top of that, HUR says the cyber operation was timed to land while the physical infrastructure was already coming apart.
That timing is the whole point of the claim, and the scenario it sketches is the part the industry keeps failing to absorb. On this account it was not a cyberattack with a kinetic anecdote attached. It was one campaign with two delivery mechanisms, presented as deliberately synchronised so that recovery from each would obstruct recovery from the other. Nobody outside the operation can confirm it played out that way, and it does not matter much for planning purposes, because the scenario is buildable and nothing prevents it. Imagine it as a planning case and the questions write themselves. You cannot reroute orders to a backup fulfilment centre that no longer has a roof. You cannot restore payment processing if the people who would do it are standing in the middle of a physical crisis. Resilience plans are written as if disruptions queue politely and take turns. Nothing obliges them to.
There is a second thing here that risk committees will not want to minute. Calling yourself a civilian commercial platform does not keep you off anybody’s target list. What the law says about your status and what an adversary decides to hit are two separate questions, and only one of them is yours to answer. Kyiv’s stated reasoning is explicit: in its view the company matters to Russia’s logistics network and to the financing of the war, and the platform also sells military kit. Whether that justification holds is an argument for other people. The operational fact is that a retailer, a thing that sells trainers, has been publicly designated a military target because of what flows through its logistics and its books.
Now transpose that. Every serious economy runs on a handful of commercial platforms that are load-bearing for everything else: payments, marketplaces, freight, cloud. We have spent a decade calling them critical infrastructure in policy documents and treating them as ordinary vendors in procurement. NIS2 and DORA at least force the question of concentration and continuity, though mostly as a documentation exercise, a folder of evidence produced so that a supervisor can tick a box. The folder does not survive a drone.
So the honest question for anyone doing this work is not whether your organisation could be hit by a state actor. It is narrower and more uncomfortable. Does your continuity plan contain a single scenario in which digital and physical damage arrive together, from the same adversary, on purpose, with the same team and the same supplier needed for both? If the answer is no, you do not have a resilience plan. You have a set of assumptions about how considerately you expect to be attacked.
The comfort of the click protects nothing. It never did.
Raffaele Di Marzio
All my “insane” books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html