Sobeys parent company Empire Co. Ltd. EMP-A-T says the cost of a cybersecurity breach that hit the company in November will be larger than previously estimated, representing approximately a $32-million impact after insurance recoveries.
The Stellarton, N.S.-based grocer previously estimated that the total costs to the business would be about $25-million after insurance. In its third-quarter earnings report on Thursday, Empire updated that estimate and provided further details on the costs of the November disruption, which shut down many of the company’s pharmacy services for four days and interfered with other operations for roughly one week, including self-checkout terminals and the redemption of Scene+ loyalty points and gift cards.
The company reported $39.1-million in direct costs in the quarter – such as legal and professional fees, costs to restore software and “inventory shrink,” a term that includes food spoilage and other unsellable items – though that number was reduced by insurance claims recovered so far. The company is still in the process of making claims under cyber insurance coverage and related policies, which will be recognized at a later date. Empire also reported a further $15-million impact on third-quarter profit related to sales declines and reduced operations.
Cybersecurity attacks are becoming more common and increasingly sophisticated, and Canadian retailers – which handle sensitive customer information, including credit card payments – have been targeted in recent months, including Empire, the Liquor Control Board of Ontario and most recently Indigo Books & Music Inc.
Earlier this month, Indigo admitted that “criminals” who were behind a cyberattack that took down its e-commerce operations in February said they had leaked sensitive employee information. The data, including names, bank account numbers, home addresses and social insurance numbers, was advertised for sale on the dark web, a part of the internet used for illicit purposes such as identity theft.
Empire has not specified whether the breach was because of a ransomware attack as Indigo’s was, referring to it only as a “cybersecurity event.”
“These cyber attacks are a nasty piece of business. I wouldn’t wish them on my worst enemy,” Empire chief executive Michael Medline said on a conference call Thursday to discuss the company’s results. He added that Empire is now back to “business as usual,” and is planning to accelerate investments in cybersecurity that it had planned to make over the next few years.
“We have made changes, significant changes, to all elements of our cybersecurity,” Mr. Medline said.
The retailer, which owns grocery banners including Sobeys, Safeway, IGA and FreshCo, reported that its third-quarter net earnings fell to $125.7-million or 49 cents a share, compared with $203.4-million or 77 cents in the same period the prior year. That decline included the impact of the cybersecurity event. The prior-year earnings also reflected unusually large lease termination income and higher property sales from the company’s stake in Crombie Real Estate Investment Trust.
Empire’s sales grew by 1.5 per cent in the 13 weeks ended Feb. 4, to $7.5-billion. Same-store sales – an important metric that tracks sales growth not related to new store openings – were roughly flat compared to the prior year, not including fuel sales at its gas stations. However, the company’s discount grocery banners experienced double-digit same-store sales growth in the quarter, Mr. Medline said.
Empire also announced on Thursday that it plans to merge Grocery Gateway e-commerce service owned by Longo’s into its Voilà online grocery platform, starting in July.
Editor’s note: This article as been updated to clarify that hackers threatened to leak Indigo employees’ data to the dark web, and leaked data was advertised for sale.