London Drugs says some company data may have been compromised in cybersecurity incident

London Drugs now confirms some company data may have been compromised in a cybersecurity incident that shuttered western Canada stores weeks ago.

The company first reported the incident on April 28, with locations forced to close for several days.

“Upon discovering the incident, we immediately deployed countermeasures to secure our network and data from further malicious acts and engaged third party cybersecurity experts to assist with containment, remediation, restoration and to conduct a forensic investigation to determine the cause and extent of the incident,” London Drugs said in a statement on May 18. It notes law enforcement and privacy commissioners were also notified.

The company reiterates there is no indication to suggest any patient or customer databases were compromised. 

“While our primary employee specific databases do not appear compromised, through our ongoing forensic investigation, we have however found evidence indicating that certain corporate files may have been compromised, some of which contain employee personal information,” the statement reads. 

“At this time, we are not yet able to provide any specifics on the nature or extent of employee personal information potentially impacted, as we are in the process of reviewing the impacted data.”

London Drugs says it has notified all employees “out of an abundance of caution,” adding it is also offering them “24 months of complimentary credit monitoring and identity theft protection services, regardless of whether any of their data is ultimately found to be compromised or not.”

“Our review of the impacted data has begun, but due to the file structures and extent of the impact which rendered many files unreadable, we anticipate that it will take time to complete. Once we have completed our review, we will contact any affected employees directly to inform them of what personal information of theirs was compromised, if any,” London Drugs continued.