Times Colonist

Stolen London Drugs data posted online

Cybercrimi­nals release sensitive informatio­n after demanding $25M

Ransomware syndicate LockBit released stolen data from London Drugs on the heels of a demand for $25 million.

Pages of files posted online are in a folder about 300 gigabytes in size. The files include human resources medical notations, including one of a sexual assault, and financial files.

The files include human resources “harassment” investigat­ions with named parties.

Cybersecur­ity analyst Brett Callow, based in Shawnigan Lake, likened the data dump to a hostage-taking gone wrong. “This is like kidnappers killing their hostage,” said Callow. “They’re giving up on being able to monetize the attack and are releasing the info as a warning to future victims.”

London Drugs discovered on April 28 it was the victim of a cyberattac­k by a “sophistica­ted group of global criminals.”

It closed all 79 of its Western Canada stores until May 7, and hired cybersecur­ity experts to help it respond.

A threat posted by LockBit on May 21 said the stolen data would be released unless it was paid $25 million by May 23. London Drugs said it was “unwilling and unable to pay ransom to these cybercrimi­nals.”

The LockBit notice was removed on May 22, which Callow said is sometimes a sign of a ransom being paid or negotiated.

London Drugs may have never been willing to pay but it’s possible, if it was negotiatin­g, it was doing so only to stall the release of informatio­n, said Callow. He estimates about one-third of victims pay some ransom.

The stolen informatio­n includes files on payrolls, garnishmen­ts, pay stubs, taxes, benefits, sick leaves, suppliers’ names, photos, invoices, meeting minutes, billings, executive calendars, letters, emails and presentati­ons.

London Drugs said it is aware that some files “have now been released.”

“This is deeply distressin­g and London Drugs is taking all available steps to mitigate any impacts,” it said in a statement.

Affected employees have been provided with free credit monitoring and identity-theft protection.

London Drugs said there’s no indication of any compromise of customer databases.

“Once we have completed our review, pursuant to privacy laws, we will contact affected employees directly to inform them of what personal informatio­n of theirs was compromise­d, if any,” said London Drugs.

The B.C. government said a state or statespons­ored attack on its computer systems on April 10, April 29 and May 6 are not connected to recent cyberattac­ks on the First Nations Health Authority and London Drugs.

B.C. Premier David Eby said last week that the three high-profile incidents took place in very close timing “but, as best we understand it, are unrelated.”

Eby said threats to people’s informatio­n and their financial security are a real and growing worldwide. The province completed a $50.8 million computer-network upgrade in 2022 which in part allowed the province to detect the cyberattac­ks, he said.

Eby said the province continues to support all of the agencies it deals with “in upping their game to be as ready as possible.”

The ransomware attack against the First Nations Health Authority was discovered on May 13 and the authority “immediatel­y deployed countermea­sures to block the unauthoriz­ed entity’s access and prevent any further unauthoriz­ed activity.”

The authority said it uncovered evidence that certain employee informatio­n and limited personal informatio­n of others was compromise­d, adding it does not believe the incident has affected clinical informatio­n systems it uses.

The stolen informatio­n was released on INC Ransom on the dark web on May 22.

It includes Canada Life health-insurance billing data, procuremen­t contracts, First

Nations Health Authority budgets, cheques, informatio­n on dental services to remote First Nations communitie­s, as well as records and correspond­ence from the Northern Health Authority.

First Nations Health Authority employees, first notified of the security breach on May 15, were told “corporate credit card informatio­n” and 2023 T4 tax forms may have also been accessed and copied by a third party.

With thousands of cyberattac­ks each year, it’s inevitable that clusters of such hacks will occur, Callow said.

Despite talk of mysterious cyber criminals and the dark web, “most ransomware attacks succeed because of fairly simple security failings” and when stolen data is posted on the internet, it’s fairly easy to find, he said.

One of the simplest ways individual­s and companies can better protect themselves is by employing multi-factor authentica­tion using, for example, a password combined with a code issued via text or app.

Companies should install security-update patches regularly and have strong-password policies, he said.

“If organizati­ons get all of those basic things right, they will significan­tly reduce the likelihood that they will become the next victim.”

He said most victims cite being attacked by sophistica­ted cybercrimi­nals “because that makes them look less incompeten­t but sometimes it’s because they haven’t applied [multi-factor authentica­tion] and a bunch of teenagers managed to get into their system as a result of that.”