The parent company of the Sobeys grocery store chain says a cyberattack last month will cost $25 million.
The grocery store operator disclosed the estimate in second quarter results released Thursday by Empire Co.
“Empire estimates, based on available information, that the financial impact on fiscal 2023 annual net earnings will be approximately $25 million, net of insurance recoveries,” the company said.
The report does not clarify the nature of the attack, whether it was ransomware or if any ransom was paid.
The company owns 1,500 stores across Canada, including Sobeys, Lawtons, IGA, Safeway, Foodland, Needs and other grocery outlets. Empire reported it earned $189.9 million in its most recent quarter, up eight per cent from $175.4 million in the same quarter last year.
Employees have told CBC News the cyberattack did involve ransomware and caused turmoil at Empire-owned stores across the country. Staff at in-store pharmacies were unable to access their computers to fill prescriptions for several days following the attack and some outlets ran short of items.
The company is still investigating whether customers’ personal data was stolen in the attack.
If it finds data has been removed, it will take steps with privacy regulators and impacted individuals, it said.
“The company takes the protection of personal information as critically important.”
Nov. 4 attack
Sobeys was hit with what it now calls a “cyber security event” on Nov. 4.
It was previously described as an “information technology systems issue.”
Empire says cyber security experts were immediately hired, the source isolated and measures taken to prevent further spread.
Pharmacy services were shut down for four days.
Self checkouts, gift cards and points were impacted for about a week, the company said.
“Other than this, customers would have noticed very few changes to their normal shopping experience,” Empire said in its statement.
Information and administrative systems are being brought back on line “in a controlled, phased approach.”
“Empire has been able to operate its retail network with little disruption and no disruption to the supply chain.”
Empire said it has cyber insurance but there may be a lag between “the incurrence of costs and confirmation of insurance proceeds.”
It says the attack will not have a material impact on its bottom line in 2023.
For all the latest business News Click Here
