Breach of personal information a concern following London Drugs 'cybersecurity incident': tech security expert

A Calgary-based technology security expert is raising concerns about the potential breach of personal data in a cyber security incident that forced London Drugs to close its doors.

More than 80 London Drugs stores across Western Canada remained closed on Tuesday as the company dealt with the cyber threat, first found on Sunday.

“We don't know exactly what's going on, except that something really bad happened to London Drugs,” Tom Keenan, a professor who researches computer security and tech crime at the University of Calgary, said.

• The information you need to know, sent directly to you: Download the CTV News App

The retailer is now saying that personal data may have been compromised in the incident, marking a reversal from a previous statement indicating the company had no reason to believe any such personal information had been breached.

Keenan says it’s surprising the company blackout has lasted for three days and that London Drugs could face concerns if any personal data such as emails, banking or medical information was compromised.

"If the bad guys hypothetically had that information, they could threaten to expose it on the internet and that could be embarrassing," said Keenan.

"Or another scenario, they can maybe send you an email if they got your email address from London Drugs that says your prescription is up for renewal, put in your credit card. So there's all kinds of possibilities for fraud here.”

London Drugs said it is working with third-party security experts to bring its systems back online.

"Our investigation is currently assessing the extent to which any data has been compromised in the incident," read a company statement.

"In the event our investigation determines that personal information was impacted, we will notify affected individuals in accordance with privacy laws."

London Drugs says it has temporarily disabled its telephone lines as part of its internal investigation into the attack, with no timeline on when the stores will reopen.

The company has barred customers from its stores unless it’s for urgent pharmacy care.

Pharmacy staff will remain at London Drugs locations to assist those customers with urgent medical needs, according to the company.

"We advise customers to visit their local store in person during regular business hours for immediate support and until the phone lines are back in service," the statement said.

Calgary shopper Galiya Burgess says she was shocked to have learned the store was closed.

"I was planning to buy something there last week when I was here, and I thought to do it today," she said.

"It's not good. It's not good at all. Not good for the business. Not good for people."

London Drugs originated in Richmond, B.C. and operates stores in British Columbia, Alberta, Saskatchewan and Manitoba.

With files from CTV News Vancouver