Brett Bundale
The Canadian Press
Sobeys parent company Empire Co. Ltd. has shared new details on a cyberattack that shut down its pharmacy services and other in-store functions last month.
The security breach in early November left customers unable to fill prescriptions for four days, while other in-store functions such as self-checkout machines, gift card use and the redemption of loyalty points were offline for about a week.
The cybersecurity event is expected to cost $25 million after insurance recoveries, Empire said Thursday.
But the company, which owns drugstore chain Lawtons Drugs, declined to reveal the total cost of the disruption.
“We’re not going to provide the gross amount,” Matt Reindel, chief financial officer of Empire and Sobeys, said during a call with analysts to discuss the company’s latest financial results.
“We are estimating a net impact of $25 million to net earnings. This estimate includes certain business losses, such as shrink and additional labour, and then direct costs such as IT professional expenses and legal expenses.”
It remains unclear whether any personal information was stolen during the breach, or if Sobeys paid any sort of ransom.
Michael Medline, president and CEO of Empire and Sobeys, said the company took action as soon as the cyber “intrusion” was discovered.
“We immediately began to isolate the source and shut down certain systems to prevent further spread and to protect our operations and our data,” he said during the conference call.
“This ensured that we were able to run our stores with little disruption and with thankfully no interruption to our supply chain. But this event and our precautionary response did cause some temporary problems.”
While customer-facing services have been fully restored for some time, the company said it’s continuing to bring information and administrative systems back online in a phased approach.
