Sobeys parent company says cyberattack expected to cost $25M after insurance

Sobeys parent company Empire Co. Ltd. has shared new details on a cyberattack that shut down its pharmacy services and other in-store functions last month.

The security breach in early November left customers unable to fill prescriptions for four days, while other in-store functions like self-checkout machines, gift card use and the redemption of loyalty points were offline for about a week.

The cybersecurity event is expected to cost $25 million after insurance recoveries, Empire said Thursday.

But the company, which owns drugstore chain Lawtons Drugs, declined to reveal the total cost of the disruption.

“We’re not going to provide the gross amount,” Matt Reindel, chief financial officer of Empire and Sobeys, said during a call with analysts to discuss the company’s latest financial results.

“We are estimating a net impact of $25 million to net earnings. This estimate includes certain business losses, such as shrink and additional labour, and then direct costs such as IT professional expenses and legal expenses.”

It remains unclear whether any personal information was stolen during the breach, or if Sobeys paid any sort of ransom.

Michael Medline, president and CEO of Empire and Sobeys, said the company took action as soon as the cyber “intrusion” was discovered.

“We immediately began to isolate the source and shut down certain systems to prevent further spread and to protect our operations and our data,” he said during the conference call.

“This ensured that we were able to run our stores with little disruption and with thankfully no interruption to our supply chain. But this event and our precautionary response did cause some temporary problems.”

While customer-facing services have been fully restored for some time, the company said it’s continuing to bring information and administrative systems back online in a phased approach.

Empire said its in-house security team is still investigating the event with the assistance of leading cyber defence firms.

If the investigation finds data has been removed from its systems, Empire said it will take “all required steps with privacy regulators and impacted individuals.”

Empire reported earnings of $189.9 million or 73 cents per share in its latest quarter, up from $175.4 million or 66 cents per share in the same quarter last year.

Sales in what was the second quarter of the company’s 2023 financial year totalled $7.64 billion, up from $7.32 billion in the same quarter last year.

Same-store sales were up 3.9 per cent, while same-store sales, excluding fuel sales, were up 3.1 per cent.

The company’s food retailing business – which operates several chains including Sobeys, Safeway, FreshCo, Farm Boy and Foodland – recorded net earnings of $158.0 million during the quarter, down from a profit of $159.3 million during the same period last year.

Meanwhile, Empire announced plans to sell 56 gas stations in Western Canada to Shell Canada subsidiary Canadian Mobility Services Ltd. for about $100 million in cash.

“In reviewing our portfolio, we determined that our fuel business in the West -which does not have a meaningful convenience store business – is not core to our offering,” Medline said.

“This sale allows us to realize the value of these assets while continuing to benefit from the foot traffic generated by these sites. Shell is a good partner and through their investment in these sites we expect to see increased benefits to both their business and our nearby grocery stores.”