From a cyberattack that downed its website for weeks to the departure of its famed founder, Indigo Books & Music Inc. has faced plenty of turmoil in recent years. An Indigo bookstore is seen Wednesday, November 4, 2020 in Laval, Que. THE CANADIAN PRESS/Ryan Remiorz
TORONTO – From a cyberattack that downed its website for weeks to board unrest and the departure of its famed founder, Indigo Books & Music Inc. has faced plenty of turmoil in recent years.
Here’s a timeline of what has gone on at Indigo since founder Heather Reisman began winding down her time at the company:
Sept. 6, 2022: Indigo announces Peter Ruis, its president, will take over the chief executive role from Reisman, Indigo’s founder, who will become executive chair of the board. Andrea Limbardi, Indigo’s chief customer and digital officer, takes on the president’s job.
Feb. 8, 2023: In a Twitter post at 2:15 p.m. ET, Indigo says the company is experiencing “technical issues” and its website isn’t available. The retailer says its stores are open, but for cash transactions only. At 7:26 p.m. ET, the company shares an update saying it had experienced a cybersecurity incident and is working with third-party experts to investigate and resolve the situation.
Feb. 14, 2023: Indigo assures the public that customer credit and debit information was not stolen during the cyberattack, as it does not store the full numbers in its system. Plum reward points were also unaffected by the breach, Indigo says. Its website remains down on Valentine’s Day, a key retail event during the typically sluggish winter months.
Feb. 17, 2023: Indigo says its investigation has found no indication that customer data was compromised by the cybersecurity incident. The company says its stores can now accept returns and exchanges, and its return policy has been extended for some cases. The retailer also unveils a new, browsable-only temporary online shop.
Feb. 22, 2023: Indigo announces that customers are now able to make purchases of “select books” online and browse other products.
Feb. 24, 2023: Indigo says the data of current and former employees was stolen in a ransomware attack. In a statement on its website, the Toronto-based company says it has contracted consumer reporting agency TransUnion of Canada to offer two years of credit monitoring.
March 1, 2023: The company announces it has decided not to pay the ransom in the cyberattack. Indigo says its network was hijacked via a ransomware software known as LockBit. The retailer says it does not know the identity of those behind the attack but says LockBit has been used by Russian organized crime groups, and it cannot be assured that any ransom payment would not end up in the hands of terrorists or others on sanctions lists.
March 2, 2023: The company says the criminals responsible for the attack intend to make some or all of the data they have stolen available using the “dark web” as early as March 2. The company says it’s continuing to work closely with Canadian police services and the FBI in the United States in response to the attack.
March 8, 2023: The company’s website appears to be back, although a notice suggests that the online inventory is in the process of being updated. It is still recommended that consumers contact local stores to ensure a specific product is in stock and available for purchase. Indigo reveals its data leak included information on medical leaves and immigration applications linked to current and former employees of the bookstore chain.
March 11, 2023: United Food and Commercial Workers International Union Local 1006A, a union representing 200 Indigo workers, calls on the retailer to disclose more information about the scope of its recent data breach and offer additional support to staff affected by the cyberattack.
June 7, 2023: Indigo says Reisman will retire as executive chair and from the board effective Aug. 22. The announcement is made as four of Indigo’s 10 directors – Frank Clegg, Howard Grosfield, Anne Marie O’Donovan and Chika Stacy Oriuwa – reveal they are also leaving the Indigo board. Oriuwa attributed her resignation to a “loss of confidence in board leadership” and “mistreatment.”
June 28, 2023: Indigo reports a loss of $49.6 million its latest financial year as it grappled with the impacts of the cyberattack.
Aug. 22, 2023: Reisman retires from Indigo.
Sept. 5, 2023: Apparel business Reitmans Canada Ltd. announces Andrea Limbardi, Indigo’s president and a 21-year employee of the company, would become its chief executive.
Sept. 7, 2023: Indigo chief executive Ruis resigns. He will remain a consultant with the company for the following two months. In the interim, chief financial officer Craig Loudon and Damien Liddle, the company’s general counsel, will work closely with the board to provide day-to-day direction.
This report by The Canadian Press was first published Sept. 7, 2023.
Companies in this story: (TSX:IDG)
