So this is a bit different. After getting pwned by hackers which shut down their stores, the president and COO of London Drugs has done two things that catch my attention as stores have started to reopen:
President and chief operating officer Clint Mahlman issued a letter Wednesday offering his “sincere apologies for the inconvenience and any concerns” that arose amid the week-long closure of the company’s 79 stores across British Columbia, Alberta, Saskatchewan and Manitoba.
While Mahlman didn’t elaborate on the nature of the breach targeting the company, he said the retailer had security measures in place, but “given the rapidly evolving landscape of cybersecurity threats, no organization can be 100 per cent safe from advanced cybersecurity incidents orchestrated by sophisticated third parties.”
I have to give him credit for apologizing for getting pwned. While they shouldn’t have been pwned in the first place, this is the next best thing. The second thing that he did was put out some more details:
The Richmond, B.C.-based retailer says it has found no evidence that customer databases, including health data from its pharmacies, were compromised in the cybersecurity breach.
“However, should we discover any evidence that customer information was impacted, we will inform our customers and privacy commissioners in accordance with privacy laws,” the company president said.
“At the outset, we proactively alerted the privacy commissions in the provinces we operate in and have reported this incident to law enforcement.”
While this can change at any point, it’s good news that no health data was swiped…. That they know of. There’s also this:
Beyond forcing the retailer to close its physical locations, the security breach also prompted company leadership to temporarily disable its telephone lines as part of a system-wide effort to locate and contain the breach.
“As soon as we became aware of suspicious activity in our environment, we immediately engaged third-party cybersecurity specialists from across North America to assist with containment, mitigation, and to conduct a forensic investigation,” Mahlman said. “Our investigation is ongoing.”
I for one hope that they continue this transparency and show the results of their investigation. I say that because if London Drugs really wants to restore the trust of their customers, they have to make that public along with how intend to avoid getting pwned again. Let’s see if they do that.
Bad News: London Drugs Data Leaked By Hackers
Posted in Commentary with tags Hacked, London Drugs on May 24, 2024 by itnerdRemember the London Drugs hack? It shut down their stores for a while. And it caused their president to apologize for getting pwned. There’s a new chapter in this saga, and The Canadian Press has the details:
Retailer London Drugs says cybercriminals who stole files from its corporate head office last month have released some of the data after it refused to pay a ransom.
The Richmond, B.C.-based company says in a statement the files may contain “some employee information,” calling it a “deeply distressing” situation.
This statement comes in response to this Tweet from Brett Callow who is in a position to know these things:
So now we know that LockBit was the group who pwned London Drugs. And we know they swiped data. Though that part should have been a given as that’s how these groups operate. Right now we know that employee data was swiped. But they could have gotten more. And given that London Drugs refused to pay the ransom, as they should, then we’ll find out soon enough what else LockBit swiped.
This does bring up a question. If Brett Callow didn’t disclose this on Twitter, would London Drugs have said anything? Riddle me that Batman.
Leave a comment »