Retail and pharmacy chain London Drugs has confirmed some employee personal information was compromised in a cyberattack in late April.
The retailer had to shut down its nearly 80 stores across B.C., Alberta, Saskatchewan and Manitoba for a week after the cyberattack was reported on April 28.
Company president Clint Mahlman did not reveal the exact nature of the attack in an interview with CBC News, but said an initial investigation has revealed no patient or customer information was accessed.
In a statement on Saturday, the retailer did confirm, however, that some corporate files were compromised in the breach — some of which contained workers’ personal information.
London Drugs president and COO Clint Mahlman tells The National’s Ian Hanomansing about the cyberattack that shut down all of its stores for days and how an outpouring of support from staff and the community helped the company navigate the crisis.
“At this time, we are not yet able to provide any specifics on the nature or extent of employee personal information potentially impacted, as we are in the process of reviewing the impacted data,” a London Drugs spokesperson wrote in the statement.
The spokesperson said that, as a precautionary measure, the company has offered all of its employees 24 months of credit monitoring and identity theft protection services, “regardless of whether any of their data is ultimately found to be compromised or not.”
The company also said that it has informed the relevant privacy commissioners of the compromised data, and it is continuing to work with third-party cybersecurity investigators and police to investigate the initial cyberattack.
London Drugs stores were abruptly closed across western Canada on Sunday due to a “cybersecurity incident.” The CBC’s Edzi’u Loverin spoke to people on the streets of Vancouver to get their thoughts on the impact of the closure.
“Our review of the impacted data has begun, but due to the file structures and extent of the impact which rendered many files unreadable, we anticipate that it will take time to complete,” the spokesperson added.
“Once we have completed our review, we will contact any affected employees directly to inform them of what personal information of theirs was compromised, if any.”
The cyberattack on April 28 prompted London Drugs, which is headquartered in Richmond, B.C., to close its stores for that entire week. All stores had only fully reopened by the following Tuesday, May 7.
While some pharmacists remained on hand to assist with urgent needs, the majority of the company’s services were taken offline during that time — including its phone lines for a brief period.
Mahlman had told CBC News that he would not reveal the exact nature of the attack, as doing so would put the company further at risk.
“These attacks have very consistent patterns,” he told the CBC’s Ian Hanomansing in an exclusive interview on May 8, in which he referred to “international threat actors.”
“One of those methods is they monitor media and they look at media, social media, customer speculation as forms of intelligence to further determine if they can attack us through different ways and through different leverage points.”
London Drugs stores across Western Canada were suddenly closed on Sunday after the company said it was a “victim of a cybersecurity incident.” Cybersecurity expert Francis Syms explains what challenges the company could be dealing with.
Staff continued to be paid during the multi-day closure, Mahlman said. He added that the company went ahead with employee anniversary celebrations, including recognizing its first 50-year staff member.
The retailer opened in 1945 and sells everything from pharmaceuticals to groceries and electronics.
15:37What else is as iconic as London Drugs?
When London Drugs closed for a week due to a cyberattack, many of us realized what a unique role it plays in our lives. Where else could you get a vacuum, toothpaste, and (once upon a time) an Atari 2600? On this episode we talk London Drugs – and other iconic brands on the Island.