Indigo website still offline nearly 1 week after cybersecurity incident

Almost a week after being hit with an apparent cyberattack, book retailer Indigo's website is still offline, leaving customers with more questions than answers.

The TSX-listed bookseller's website went dark on Wednesday, Feb. 8. Indigo's brick-and-mortar stores could not process any transactions that were not in cash, leaving anyone who wanted to return or buy an item using debit, credit or gift cards in the lurch.

Within hours, the company posted a message on its website, saying it "experienced a cybersecurity incident" and was communicating with customers via its social media channels.

Through the weekend, physical stores had regained most functionalities, except the ability to process returns after the company changed its in-store payment technology as part of its incident response. 

But the website remains offline as of Tuesday afternoon, almost a week after it first went dark.

That's bad news for the company, as it makes it impossible to process any new sales online. But it's also bad news for customers, like Gabriel Lee, who ordered a gift for his girlfriend online last week that was scheduled to arrive last Friday; it's now stuck in transit on Valentine's Day, with no indication of when it might arrive.

"There's absolutely no way I can tell if it's coming, like, this week or next week," he told CBC News in an interview. "There's no timeline for it, so unfortunately, I'm going to just have to wait it out and see. And then see if they offer compensation … but I don't think they will."

Indigo said Tuesday in a statement posted to social media that customer debit and credit card information was not compromised.

The company has been relatively tight-lipped about what's happened, but multiple cybersecurity companies interviewed by CBC News say the incident has all the hallmarks of what's known as a ransomware attack. That's the term for when hackers infiltrate a company's internal systems, disable them, then demand a ransom to undo what they've done.

It's a growing problem. Statistics Canada says ransomware attacks amounted to 11 per cent of all cyber security incidents in 2021 — the most recent year for which up to date data is available.

Grocery chain Sobeys was a recent high-profile victim, with the company being hit by a ransomware attack in November that left the chain unable to fill prescriptions at the its pharmacies for four days, while other in-store functions, like self-checkout machines, gift-card use and the redemption of loyalty points, were offline for about a week.

In its most recent quarterly earnings, the company said the incident cost it about $25 million.

Cybersecurity expert Cat Coode says it's "very likely" that Indigo has been hit by something similar. The timing and duration of the outage suggests it's something external, she says, as does the sheer number of systems involved, including payment and inventory systems both in store and online.

"The fact that we see two separate and distinct systems that have gone down is an indication that this is a malicious attack and not an accident that's happened inside the company," she said.