Inside the turmoil at Sobeys-owned stores after ransomware attack

Employees of Empire Co., the parent company of Sobeys, have begun to speak out about the turmoil unfolding inside the grocery chain since a ransomware attack began plaguing its computer systems earlier this month.

Workers from across the country say some stores have run short of items because orders cannot be placed as usual, while at others, food that had gone bad initially either piled up or was frozen because it couldn't be removed from the inventory system.

Pharmacies were unable to fill new prescriptions for a week, customers cannot redeem loyalty points or use gift cards, and staff were concerned last week they wouldn't get paid because the payroll system is down.

"It's basically been a mess.… The word that can best describe it — just a mess," said one employee who works in the front end at a Safeway in western Canada.

The CBC has agreed to protect the identities of employees it has spoken to, as they are worried they'll be fired if the company knows they shared internal information.

Empire announced in a news release Nov. 7 that an "information technology systems issue" was disrupting some services, including filling prescriptions at pharmacies. The company did not respond to questions from the CBC last week, but said in a statement Nov. 11 its pharmacies were once again fully operational, though stores were still experiencing challenges.

The company owns 1,500 stores across Canada, including Sobeys, Lawtons, IGA, Safeway, Foodland, Needs and other grocery outlets.

Several cybersecurity experts have said they suspect the company's systems were hacked, and a ransomware attack — when hackers lock computer systems until money is paid — could be to blame.

The employees who spoke with the CBC said ransomware was indeed the cause of the problem.

"Somebody higher up got an email and basically clicked a link they weren't supposed to," said the front-end Safeway employee. "I don't know the exact dollar figure, but I know it was like millions, like several millions."

The troubles began overnight Thursday, Nov. 3 into Friday, Nov. 4.

When employees arrived for work on Friday, their computers took longer than usual to boot up, and when they finally did, "nothing came up other than this big white block in the middle of the screen that said ransomware, please comply before proceeding, or something like that," said a worker in a meat and seafood department at a Safeway store.

"I saw the word ransom and that scared me right away."

Employees were told not to log in, to unplug certain digital scales, and not to use the scanning equipment that allows them to track inventory.