Canadian grocery chain says cyberattack cost $25 million

The parent company of the Sobeys grocery store chain in Canada, Empire, has said that a cyber-attack last month is expected to cost some $25 million, net of insurance recoveries.

The company owns 1,500 stores across Canada, including Sobeys, Lawtons, IGA, Safeway, Foodland, FarmBoy, Needs and other grocery outlets. 

According to local media reports, the cyber-attack involved ransomware and caused disruption at Empire-owned stores across the country, with staff at in-store pharmacies unable to access their computers to fill prescriptions for several days following the attack.

The company is still investigating whether customers’ personal data was stolen in the attack.

If it finds data has been removed, it will take steps with privacy regulators and impacted individuals, it said.

The $25-million figure includes loss of product and direct costs such as informational technology, professional expenses and legal expenses. Empire said it has cyber insurance but there may be a lag between “the incurrence of costs and confirmation of insurance proceeds.”

It added that the attack is not expected to have a material impact on its bottom line in 2023.