Indigo Books & Music shut down its website after a cyberattack

Indigo Books & Music, Canada's largest bookstore chain, took its e-commerce site offline on February 8, 2023 after what it first described as technical issues and then confirmed as a cyberattack on its computer systems.

With payment systems disrupted, stores were briefly restricted to cash only and gift cards could not be used. Online orders faced delays, and customers could not process returns and exchanges or search in-store inventory. Indigo later adjusted its in-store payment technology so debit, credit and gift card transactions could resume.

The company said it was working with third-party experts to determine whether the intruders had gained access to or stolen customer data. It said customer credit and debit card information had not been compromised because it does not store full card numbers in its systems, and that loyalty points were unaffected.

Indigo did not initially say what kind of attack it was. BleepingComputer noted that Indigo credentials harvested by information-stealing malware had been offered on cybercrime markets in January and February 2023, and said ransomware was plausible but unconfirmed. Indigo later confirmed the incident was ransomware and that employee data had been taken. In a letter to staff on March 1, 2023, president Andrea Limbardi said the network had been accessed using ransomware known as LockBit, and that Indigo would not pay the ransom because it could not be assured the money would not reach people on sanctions lists and because some criminal groups using LockBit are affiliated with Russian organized crime.

The outage ran past a week, and Indigo eventually stood up a temporary browse-only website while its main platform remained down and the investigation continued.