Sobeys’ silence on 'IT systems issue' lingers more than a week after disruption

The silence continues from Sobeys’ parent company about its so-called “IT systems issue” and what, if any, impact it had on personal information.

Empire Company Ltd., which owns chains. including Sobeys and Lawtons Drugs, isn’t responding to media requests a week after it first confirmed “significant disruptions” at its retail locations, specifically pharmacies.

“The fact that they’re not publicly giving more information tells us they’re still in the throes of trying to bring everything back up again and running,” says Scott Beck, CEO of Moncton-based BeckTeck IT services and supports. “I’m hearing the pharmacies are starting to come back online, which helps to kind of indicate this is most likely a ransomware attack that has some pretty severe implications.”

Quebec's access to information commission and Alberta’s privacy commissioner both confirm receiving data breach reports from Empire.

The Information and Privacy Commissioners in both Nova Scotia and Prince Edward Island say its respective offices haven’t received any reports from Empire. The New Brunswick Ombud says its office doesn’t confirm one or another what reports are received.

Empire’s reluctance to share information isn’t a surprise to Brett Callow, a threat analyst with Emsisoft, a New Zealand-based cyber security company. Callow says Empire has likely been given legal advice to remain quiet.

However, Callow says transparency from the company could be a help to customers, employees, and other at-risk companies.

“If you are aware that something has happened, you can be on the lookout,” says Callow. “’Forewarned is forearmed,’ as they say.”