Security1 publisher2 min readPublished
Wildberries blames its own DDoS defenses for weeks of frozen seller payouts
The marketplace says security measures added after a DDoS attack can suspend transfers while it is under way, which is how some merchants went unpaid for weeks. The sellers' union counts 20 billion rubles outstanding and doubts the account.
The Watch · Security desk
What happened
- Wildberries told Russian media that payments to some sellers were delayed by security measures introduced after a DDoS attack hit the systems merchants use to track and withdraw their earnings.
- The Russian Union of Marketplace Sellers says about 20 billion rubles is still owed on goods sold in the final week of July, after merchants complained of weeks of delay.
- The union wrote to Prime Minister Mikhail Mishustin asking for government supervision, asked the antitrust authority to examine the delays, and asked the tax service to account for the cash-flow gap.
- Ukraine's military intelligence said in August that an operation run with the Cyber Corps hacking group disrupted Wildberries' customer service, contact centers and payment systems.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- cost Merchants carry the float. The platform loses no money here, while sellers whose July receipts have not landed cover restocking and payroll out of their own reserves and are told the funds are safe.
- contradiction Wildberries says most sellers were paid; the union says 95.6% of its respondents were not, and that foreign sellers were paid on time, which points at something more selective than a blanket transfer suspension.
- precedent A protective control that halts transfers hands any platform a payout-delay explanation nobody outside can check without the transfer logs, which is why the regulator referral is the part with teeth.
- capability Ukrainian intelligence is claiming an effect priced in supplier cash flow rather than site downtime, timed to compound strikes on the same company's warehouses.
The control at the center of this is a fail-safe on the payout rail. Wildberries has said its security systems can temporarily suspend the processing of some transfers while an attack is under way, so withdrawal requests take longer than usual [8]. In a pure availability incident that is the conservative setting. On a marketplace payout system it turns pressure on the front end into a stoppage on the money side, and the company's position is that the funds are intact and will move once the necessary "technical procedures" are done [2].
The numbers do not sit comfortably together. Wildberries told Kommersant that most sellers had received their money and only some payments were still held up by the DDoS [7]. The Russian Union of Marketplace Sellers surveyed nearly 2,000 sellers and found 95.6% had not received payments they expected [5], which leaves 4.4%, roughly 88 respondents, on the paid side of that sample [16]. Both statements can stand if the survey drew disproportionately on aggrieved merchants. Neither side has published transfer volumes to settle it.
The union's rebuttal was that it is "very convenient to hide behind external factors, especially technical ones," and that foreign sellers kept being paid on schedule through the same period [9]. That second point is the load-bearing one. A generic transfer-suspension control does not normally sort by seller nationality, so if the claim holds, throttling alone does not explain the pattern.
There is no published date for the attack itself. Wildberries has not disclosed details or attributed it to any group [3], and has not said whether the DDoS it blames for the delays is connected to the operation Ukraine's Main Intelligence Directorate announced in August alongside the Cyber Corps group [12]. The only firmly anchored window in the story is commercial: sales from the last week of July [4].
HUR's stated purpose is worth reading next to the physical record. The agency said the operation was meant to amplify the damage from Ukrainian strikes on Wildberries warehouses [11], and Russian media estimate the company has lost more than 1.2 million square meters of warehouse space to such attacks [13]. Wildberries has also reportedly offered drone components and body armor on the platform [14]. The effect being claimed lands on the supplier base of one of Russia's largest online marketplaces [17], not on its storefront.
The 20 billion rubles is the sellers' figure for a single week of sales, reported as about $240 million [4][15]. Whether that sum was held by an attack, by the defense against it, or by something else in the ledger is not auditable from outside the transfer logs.
What to watch
- Whether Russia's antitrust service opens a formal review, which would put Wildberries' technical account on the record with dates and transfer volumes.
- Whether Wildberries ever dates the DDoS attack or links it to the operation HUR announced in August.
- Whether the sellers' union substantiates its claim that foreign sellers were paid on schedule while Russian sellers were not.