Indigo web page nevertheless offline just about 1 week following cybersecurity incident

Almost a 7 days right after getting hit with an clear cyberattack, book retailer Indigo’s web page is nevertheless offline, leaving customers with more issues than answers.

The TSX-outlined bookseller’s web-site went dim on Wednesday, Feb. 8. Indigo’s brick-and-mortar stores could not approach any transactions that have been not in funds, leaving anybody who required to return or obtain an item using debit, credit or present playing cards in the lurch.

Within just several hours, the enterprise posted a message on its web-site, indicating it “professional a cybersecurity incident” and was communicating with clients via its social media channels.

As a result of the weekend, actual physical outlets experienced regained most functionalities, except the capacity to method returns after the organization altered its in-retailer payment technological know-how as section of its incident response. 

But the site remains offline as of Tuesday afternoon, almost a 7 days soon after it 1st went dark.

That’s poor information for the organization, as it makes it unattainable to method any new profits on the web. But it is also bad news for customers, like Gabriel Lee, who purchased a gift for his girlfriend on line last week that was scheduled to arrive past Friday it’s now stuck in transit on Valentine’s Day, with no sign of when it could possibly get there.

“There is definitely no way I can inform if it can be coming, like, this week or following week,” he told CBC Information in an job interview. “You will find no timeline for it, so however, I’m likely to just have to wait it out and see. And then see if they offer compensation … but I don’t assume they will.”

Indigo reported Tuesday in a assertion posted to social media that buyer debit and credit score card data was not compromised.

The company has been comparatively limited-lipped about what is happened, but a number of cybersecurity companies interviewed by CBC News say the incident has all the hallmarks of what is known as a ransomware attack. That is the expression for when hackers infiltrate a company’s inner techniques, disable them, then demand a ransom to undo what they have carried out.

It is a increasing problem. Stats Canada claims ransomware attacks amounted to 11 for every cent of all cyber security incidents in 2021 — the most modern yr for which up to day details is offered.

Rising trouble

Grocery chain Sobeys was a new large-profile sufferer, with the company getting hit by a ransomware attack in November that still left the chain unable to fill prescriptions at the its pharmacies for four times, while other in-retail store features, like self-checkout equipment, gift-card use and the redemption of loyalty factors, ended up offline for about a 7 days.

In its most recent quarterly earnings, the enterprise stated the incident charge it about $25 million.

Cybersecurity professional Cat Coode says it’s “pretty likely” that Indigo has been hit by one thing similar. The timing and duration of the outage suggests it really is something external, she states, as does the sheer variety of devices included, including payment and stock methods each in store and on the web.

“The simple fact that we see two independent and distinctive methods that have absent down is an indicator that this is a malicious attack and not an accident that’s transpired inside the organization,” she explained.

No matter of the lead to, the extended the outage stretches on the even worse the harm will be, states Daniel Tsai, a lecturer in law and enterprise technology at University of Toronto and Toronto Metropolitan University.

“It is really heading to have an impact on their product sales and track record simply because customers are really concentrated on the reliability of the internet site and if they can not go on … guess what, they’re not heading to occur back,” he mentioned in an interview. “The lengthier this goes on, the bigger the punishment.”

When she’s assured the retailer is probable the victim of a ransomware assault, Coode is equally confident that it is not likely delicate customer details, this sort of as credit rating-card info, was stolen.

“For the reason that there has not been an announcement that there has been a breach of personal facts suggests probable that no one has taken the details out of the business,” she claimed.

“The minute you say the phrase ‘breach,’ you fired off the alarm — you have to notify the privateness commissioner.”

By regulation, Canadian corporations that expertise cybersecurity breaches exactly where shopper data is stolen are required to report the breach to the Office environment of the Privacy Commissioner of Canada “as quickly as feasible.”

In a statement to CBC Information, the commissioner’s office suggests it “is aware” of the situation at Indigo and is “in interaction with the group in purchase to acquire extra info which include a formal breach report, and to identify subsequent measures.”

“I am not in a posture to deliver any much more facts about this subject at this time,” the spokesperson stated on Friday. 

CBC News arrived at out to the agency on Tuesday to see if that status has been up to date. 

Indigo spokesperson Melissa Perri said the business was continuing to do the job with third-social gathering specialists to look into the circumstance and understand no matter if any client facts has been accessed.