London Drugs closed all 79 stores across Western Canada after a ransomware attack

London Drugs, a privately held chain based in Richmond, British Columbia, said it discovered a cybersecurity incident on April 28, 2024 and closed all 79 of its stores across British Columbia, Alberta, Saskatchewan and Manitoba out of what it called an abundance of caution. Its e-commerce platform stopped processing orders, and phone lines were taken down during the investigation.

Pharmacists remained on site at each location to help customers with urgent pharmacy needs, and the company gave no timeline for reopening at the outset. It said it had retained third-party cybersecurity experts to assist with containment, remediation and a forensic investigation.

In its initial statements the company said it had no reason to believe that customer or employee data had been affected. Stores resumed operations by May 7.

That account changed later in May, when London Drugs confirmed the incident was a ransomware attack and said corporate files containing employee information had been stolen. LockBit claimed responsibility on its leak site, demanded $25 million and alleged that London Drugs had offered $8 million. The company said it was unwilling and unable to pay, that it had found no compromise of patient or customer databases, and it offered current employees two years of credit monitoring and identity theft protection.