The company did not go along with the ransomware, but the attackers made their move.
The LockBit group has claimed responsibility for a cyberattack on the Canadian drugstore chain London Drugs and is now threatening to publish the stolen data after failed negotiations.
The April 28 cyberattack forced London Drugs to close all of its pharmacies in western Canada. The company said at the time that it had found no evidence of customer or employee data leaks. Although all closed London Drugs pharmacies have since been reopened, the company's website remains inaccessible.
On May 21, LockBit added London Drugs to its website, claiming an April cyberattack and threatening to publish data stolen from the company's systems. Although the ransomware has not yet provided evidence that they actually stole any files from London Drugs ' servers, cybercriminals claim that negotiations with the company to pay a $25 million ransom failed.
London Drugs on
In a statement to BleepingComputer, London Drugs did not confirm LockBit's claims, but said it was aware of the ransomware's claim of stealing "corporate files, some of which may contain employee information." However, LockBit only mentioned "stolen data".
London Drugs stressed that it cannot and will not pay the ransom, but acknowledged that attackers can actually publish stolen corporate files on the darknet.
"At this stage of the investigation, we are unable to provide specific details about the nature or extent of potentially affected employee personal information. Our investigation is ongoing, but due to the scale of system damage caused by the cyber incident, we expect the process to take some time," London Drugs said.
As a precaution, the company notified all current employees in advance and provided 24 months of free credit history monitoring and identity theft protection services, regardless of whether their data was eventually compromised or not.
In total, London Drugs has more than 9,000 employees providing pharmaceutical and medical services in more than 80 locations across Western Canada, including the provinces of Alberta, Saskatchewan, Manitoba and British Columbia.
The LockBit group has claimed responsibility for a cyberattack on the Canadian drugstore chain London Drugs and is now threatening to publish the stolen data after failed negotiations.
The April 28 cyberattack forced London Drugs to close all of its pharmacies in western Canada. The company said at the time that it had found no evidence of customer or employee data leaks. Although all closed London Drugs pharmacies have since been reopened, the company's website remains inaccessible.
On May 21, LockBit added London Drugs to its website, claiming an April cyberattack and threatening to publish data stolen from the company's systems. Although the ransomware has not yet provided evidence that they actually stole any files from London Drugs ' servers, cybercriminals claim that negotiations with the company to pay a $25 million ransom failed.
London Drugs on
In a statement to BleepingComputer, London Drugs did not confirm LockBit's claims, but said it was aware of the ransomware's claim of stealing "corporate files, some of which may contain employee information." However, LockBit only mentioned "stolen data".
London Drugs stressed that it cannot and will not pay the ransom, but acknowledged that attackers can actually publish stolen corporate files on the darknet.
"At this stage of the investigation, we are unable to provide specific details about the nature or extent of potentially affected employee personal information. Our investigation is ongoing, but due to the scale of system damage caused by the cyber incident, we expect the process to take some time," London Drugs said.
As a precaution, the company notified all current employees in advance and provided 24 months of free credit history monitoring and identity theft protection services, regardless of whether their data was eventually compromised or not.
In total, London Drugs has more than 9,000 employees providing pharmaceutical and medical services in more than 80 locations across Western Canada, including the provinces of Alberta, Saskatchewan, Manitoba and British Columbia.
