London Drugs says the criminal group targeting the company has released stolen employee data previously held for ransom.
In a statement to CityNews, the company confirmed that “London Drugs has been named by cybercriminals as a victim of exfiltration of files from its corporate head office, and [it is] aware that some of these exfiltrated files have now been released.”
The company added that some of the data released could contain its employees’ personal information.
“We acknowledge that some of these files may contain some employee information – this is deeply distressing and London Drugs is taking all available steps to mitigate any impacts from these criminal acts, including notifying all current employees whose personal information could be potentially impacted and providing them with complimentary credit monitoring services and identity theft protection.
According to Emsisoft cyber threat analyst Brett Callow, the ransomware group, LockBit appears to have posted links to files containing employee data to the dark web Thursday afternoon.
The perpetrators claiming to be behind the ransom — first posted Tuesday — have been demanding that London Drugs pay $25 million in exchange for data stolen during the April cyberattack that shuttered stores for days.
The ransomware group had been threatening to leak employee information on the dark web if those demands were not met.
London Drugs did not confirm the “nature of the released documents and their contents.” The company said it holds steadfast in its refusal to pay the cybercriminals.
Speaking to CityNews Thursday, Callow says in similar cases he has seen, the removal and then relisting of the demand could indicate “the victim company entered negotiations, and those negotiations then fell through.”
“It should be noted, however, that simply because a company enters negotiations, or makes an offer, as LockBit claimed that London Drugs did, it doesn’t mean there was ever an intention to pay,” he explained.
You can watch CityNews 24/7 live or listen live to CityNews 1130 to keep up to date with this developing story. You can also subscribe to breaking news alerts sent directly to your inbox.
—With files from Charlie Carey