Indigo Slowly Recovering from Ransomware Attack
Indigo Books & Music continues slowly to return to normal after a severe ransomware attack on February 8. As the company wrote in a FAQ last week, "We immediately engaged third-party experts to investigate and resolve the situation. As part of this remediation work, we proactively shut down some of our systems to prevent data from being improperly accessed, and have been working with third-party experts to strengthen our cybersecurity practices, enhance data security measures and review our existing controls."
The proactive shutdown included the Canadian booksellers' website and store systems. Most of the store systems have returned to normal and the website is partially operating, but limited to "select books." The Indigo app is not available, and gift cards are not being accepted online but can be used in stores.
The company said that no customer data but some employee data was accessed, and "both current and former employees are being notified that their information may have been impacted. To provide additional assurance and protection to all employees, we have retained the assistance of TransUnion of Canada, Inc., one of Canada's leading consumer reporting agencies, to offer two years of myTrueIdentity credit monitoring and identity theft protection services at no cost."
Indigo has learned, it said, that "some or all of the data stolen" may be available on the dark web or available soon.
The ransomware attack was made by "criminals who deployed ransomware software known as 'LockBit,' " Indigo said. "Although we do not know the identity of the criminals, some criminal groups using LockBit are located in or affiliated with Russian organized crime. We are continuing to work closely with the Canadian police services and the FBI in the United States in response to the attack."
Indigo added that it has not paid a ransom because Canada's "privacy commissioners do not believe that paying a ransom protects those whose data has been stolen, as there is no way to guarantee the deletion/protection of the data once the ransom is paid. Both U.S. and Canadian law enforcement discourage organizations from paying a ransom as it rewards criminal activity and encourages others to engage in this activity. Additionally, we cannot be assured that any ransom payment would not end up in the hands of terrorists or others on sanctions lists."
In January, Wired noted that "since late 2019, one group has been steadily making a name for itself on a multi-year rampage that has impacted hundreds of organizations around the world. The LockBit ransomware gang may not be the most wildly unhinged of these criminal groups, but its callous persistence, effectiveness, and professionalism make it sinister in its own way."
A November 2022 statement from the U.S. Justice Department about the arrest of a LockBit participant said, in part, "LockBit is a ransomware variant that first appeared in or around January 2020. It has become one of the most active and destructive ransomware variants in the world. Since first appearing, LockBit has been deployed against at least as many as 1,000 victims in the United States and around the world. LockBit members have made at least $100 million in ransom demands and have extracted tens of millions of dollars in actual ransom payments from their victims."