Skip to content

Indigo latest target in string of cyberattacks on Canadian businesses

A cybersecurity incident that knocked Indigo Books & Music Inc.'s website and electronic payment systems offline is the latest in a string of cyberattacks experts say are increasingly targeting Canadian businesses.
20230208220216-63e465b7ce42c062ac5eaec4jpeg
An Indigo store is seen Wednesday, November 4, 2020 in Laval, Que. Indigo Books & Music Inc. says it is dealing with what it calls a "cybersecurity incident" that has affected customer orders.THE CANADIAN PRESS/Ryan Remiorz

A cybersecurity incident that knocked Indigo Books & Music Inc.'s website and electronic payment systems offline is the latest in a string of cyberattacks experts say are increasingly targeting Canadian businesses.

"It's really turned into the Wild West out there and companies are struggling," Robert Falzon, head of engineering at Check Point Canada, said in an interview Thursday.

"We're going to be seeing more of these more frequently and the damage will be longer as organizations continue to struggle with the adoption of cloud technology and the explosion of artificial intelligence. Just about anybody can be a junior hacker and start creating malware."

Indigo's website has been down since Wednesday afternoon. While the book retailer can process in-store orders paid for in cash, it cannot process electronic payments, accept gift cards or handle returns.

Indigo said it's working with third-party experts to investigate and resolve the situation and hopes to have its systems back online as soon as possible.

In response to customer questions about the service outage on Twitter, the company said it's working to restore its systems and to "understand if customer data has been accessed."

Indigo also said customers who recently purchased items online may experience delays with part or all of their order. 

The Office of the Privacy Commissioner of Canada is aware of the matter and is in communication with the organization "in order to obtain more information, including a formal breach report, and to determine next steps," spokesman Vito Pilieci said in an email.

Canadian retailers have increasingly experienced cyberattacks in recent months. 

Sobeys parent company Empire Co. Ltd. recently grappled with a security breach that shut down its pharmacy services and other in-store functions. 

The cybersecurity event in early November left customers unable to fill prescriptions for four days, while other in-store functions like self-checkout machines, gift card use and the redemption of loyalty points were offline for about a week. 

Empire said in December the incident is expected to cost $25 million after insurance recoveries.

On Thursday evening, Indigo reported earnings for its latest quarter were $34.3 million, down from $45.1 million a year earlier.

Earnings per diluted share for the third quarter ended Dec. 31 were $1.22, down from $1.60 for the same quarter in 2021.

Revenues were $422.7 million, down from $430.7 million a year earlier. 

This report by The Canadian Press was first published Feb. 9, 2023

Companies in this story: (TSX:IDG)

Brett Bundale, The Canadian Press