Major Canadian retailer finds cyberattacks “more difficult to detect”

Cyber threats are becoming “more difficult to detect,” a major Canadian retailer suggested Tuesday.

Indigo Books and Music Inc., whose holdings include the Chapters and Coles book chains, “may be required to expend significant additional resources” to protect against threats such as cyberterrorism, phishing and computer viruses, the firm said Tuesday in its management discussion and analysis of its financial results for the year ending March 31.

The threat is large enough that many retailers mention such risks in their security filings,  Imran Ahmad, a lawyer for Miller Thomson, told Canadian Underwriter earlier.

“Attacks in the retail industry are now commonplace, especially those that may relate to credit card information,” Ahmad said in April, commenting in general and not on Indigo. “It is not unknown or unexpected.”

In addition to selling books and music online, Indigo operates more than 200 stores under the Chapters, Indigo, Coles, Indigospirit and The Book Company brands. Its total revenue was $1.08 billion in the year ending March 31.

Indigo, which operates more than 200 stores across Canada, “maintains records containing sensitive information identifying or relating to individual customers and employees,” the company said in its MD&A. The book seller added it “has implemented systems and processes to comply with applicable privacy laws in connection with the collection, use, retention, and disclosure of such personal information,” but warned its reputation could be harmed “if a significant failure of such systems was to occur.”

The warning comes less than a month after Hudson’s Bay Company revealed that point of sale systems at some of its stores – including Saks Fifth Avenue – were infected by malware.

HBC reported in April that malware was intended to collect the cardholder name, payment card number and expiration date of customers’ payment cards.

Retailers face liability risk in such incidents, Ahmad told Canadian Underwriter at the time. This is because retailers can potentially be sued by consumers and the companies have to expend time and effort in dealing with regulators.