Goodwill of Greater Grand Rapids cyber incident

Analyst assessment

Goodwill Industries of Greater Grand Rapids said March 27 that an attack disrupted part of its network and resources used to operate local stores. Its 18 stores remained open but accepted only cash while the nonprofit rebuilt its point-of-sale program. The organization’s cyber-specific statement and documented store disruption establish a confirmed cyber incident.

An Interlock listing appeared March 26 under the name Goodwill Industries of North Central Pennsylvania. Our review of the post material found a Michigan tax document naming Goodwill Industries of Greater Grand Rapids and a Grandville address. The evidence supports recording a stable Interlock claim tied to the Michigan affiliate while preserving the incorrect victim label. It does not independently prove Interlock responsibility, ransomware deployment or data theft.

Operational significance

Cash-only sales limited normal checkout operations across Goodwill’s western Michigan retail network. Local reporting also documented paused returns and a one-day outlet closure during the disruption. WGVU News reported March 30 that all 18 stores remained open but were still limited to cash transactions while systems were rebuilt.

Goodwill’s retail-store locator identifies locations in Grand Rapids, Wyoming, Grandville, Kentwood, Walker, Comstock Park, Jenison, Belmont, Lowell, Greenville, Ionia, Big Rapids and Mount Pleasant. Goodwill said affiliates in other communities were unaffected because local Goodwill organizations use separate systems.

Disclosure posture

Goodwill posted cash-only notices March 14 and March 15 without a public cyber explanation. The Interlock listing appeared March 26, and Goodwill publicly called the event an attack and cyber incident March 27. This sequence supports external-first cyber characterization followed by organization acknowledgement.

Goodwill said its systems do not store credit card data, but it did not say whether employee, donor, program-participant or other personal information was accessed or copied. The Interlock material creates a credible data-risk signal, but the public record does not establish the scope, provenance or completeness of any allegedly stolen files.

Current status

The affiliate’s public site currently lists normal store hours and active locations. No later source documented continuing disruption after March 30, but Goodwill did not publish a dated restoration notice or final investigative conclusion. The incident is therefore presumed resolved rather than treated as having an authoritative all-clear.

Confidence and uncertainty

Confidence is high that the attack disrupted store-network and checkout operations because Goodwill directly acknowledged those effects. Ransomware confidence is medium: Interlock operates ransomware and data-extortion infrastructure, and the claim material appeared to match the Michigan affiliate, but Goodwill did not confirm encryption or ransomware deployment.

Threat-actor confidence is low because the evidence establishes an Interlock claim rather than independently proving responsibility. Searches using the affiliate’s canonical name and goodwillgr.org found no additional stable ransomware or extortion claim.

Analytic gaps

The public record does not establish the initial access vector, compromised systems, malware family, encryption scope, dwell time, data-exfiltration method, affected data categories, record count, ransom demand, payment status or exact restoration date. It also does not establish whether every store experienced the same duration or degree of disruption.