Indigo latest target in string of cyberattacks on Canadian businesses

By Brett Bundale

A cybersecurity incident that knocked Indigo Books & Music Inc.’s website and electronic payment systems offline is the latest in a string of cyberattacks experts say are increasingly targeting Canadian businesses.

“It’s really turned into the Wild West out there and companies are struggling,” Robert Falzon, head of engineering at Check Point Canada, said in an interview Thursday.

“We’re going to be seeing more of these more frequently and the damage will be longer as organizations continue to struggle with the adoption of cloud technology and the explosion of artificial intelligence. Just about anybody can be a junior hacker and start creating malware.”

Indigo’s website has been down since Wednesday afternoon. While the book retailer can process in-store orders paid for in cash, it cannot process electronic payments, accept gift cards or handle returns.

Indigo said it’s working with third-party experts to investigate and resolve the situation and hopes to have its systems back online as soon as possible.

In response to customer questions about the service outage on Twitter, the company said it’s working to restore its systems and to “understand if customer data has been accessed.”

Indigo also said customers who recently purchased items online may experience delays with part or all of their order.

The Office of the Privacy Commissioner of Canada is aware of the matter and is in communication with the organization “in order to obtain more information, including a formal breach report, and to determine next steps,” spokesman Vito Pilieci said in an email.

Canadian retailers have increasingly experienced cyberattacks in recent months.

Sobeys parent company Empire Co. Ltd. recently grappled with a security breach that shut down its pharmacy services and other in-store functions.

The cybersecurity event in early November left customers unable to fill prescriptions for four days, while other in-store functions like self-checkout machines, gift card use and the redemption of loyalty points were offline for about a week.

Empire said in December the incident is expected to cost $25 million after insurance recoveries.

This report by The Canadian Press was first published Feb. 9, 2023