Indigo Books & Music Inc. is addressing a so-called “cybersecurity incident” that has affected customer orders in-store and online.
It started at the Toronto-based retailer on Wednesday. As of Thursday evening, Indigo’s website was still offline.
“We are working with outside experts to investigate and resolve the situation,” the company said in a message published on its website.
“Our hope is to get our systems back online as soon as possible.”
Indigo says it can’t process electronic payments, accept gift cards, or process returns. Physical stores are limited to settling sales for cash only.
The company hasn’t revealed many details about what’s going on, but David Masson, director of corporate security at cybersecurity firm Darktrace, says the sheer length of the problem suggests it wasn’t an internal bug, but rather a rather an instance of ransomware. where hackers steal information, lock down systems and demand a ransom to unlock them.
“Their point of sale system is down … and they’ve also said they can no longer accept returns, which means they can’t bring stock back into the system.”
If “just a small part of a business goes down, it’s probably not ransomware,” he said. “But if it’s more widespread, that’s an indication that it might be.”
Ransomware “really messes up your organization and doesn’t get fixed in a couple of hours,” he said.
Latest retail attack
If it’s ransomware, that means the company has joined a growing list of Canadian retailers that have only fallen victim in the past few months.
Sobey’s parent company, Empire Co. Ltd., recently faced a security breach that crippled its pharmacy services and other functions in the store.
Due to the cybersecurity event in early November, customers were unable to fill prescriptions for four days, while other in-store features such as self-checkout, gift card use and loyalty point redemption were offline for about a week.
Empire said in December the incident is expected to cost $25 million after insurance reimbursed.
Enza Alexander, vice president of cybersecurity firm ISA, says the rise in online shopping is making retailers popular targets for cybercriminals, although she doesn’t have firsthand knowledge of what’s going on at Indigo — and they’re all the more noticeable when they happen because they are in the public eye.
“Financial Gains [are] how cybercriminals generate dollars to fund their efforts,” she told CBC News.
While she says it’s too early to tell what happened at Indigo, her advice for consumers boils down to common sense.
“I’ve always told people close to me, ‘You’re one click away from making the wrong click,'” she said.
