London Drugs closes stores until further notice due to cyberattack

[yawpitch]

Context for those outside Canada, London Drugs is more of a department store than a drug store / pharmacy. They tend to have lots of general goods, computing and camera and electronics departments, and so on. I used to sell top-end Nikon SLRs there, of all things… along with the shittiest Star Trek inspired telephones Curtis ever made.

[xyst]

Wild. These types of attacks would be mild inconveniences if they had procedures in place for continuity of business.

I am thinking:

- Manual record keeping (ie, physical ledger)

- Procedures to call insurance companies and verify coverage

- Procedures to ask local doctors to phone in (or hand write) prescription requests instead of using e-prescription system

- Credit and debit card information captured at point of sale with offline device. Processed outside of impacted systems or when systems recover

[betaby]

How 'Procedures to call insurance companies and verify coverage' prevents store shutdown? In my worldview insurance is 'sometimes we pay if ensured event occurs'. Lack or presence of the insurance changes nothing about the attack.

[itsoktocry]

Yes, let's all do business like it's 1980, just in case the internet goes down.

All of this is possible, it takes a lot more time. That's why they are moved to "emergency only" business.

[Alifatisk]

This is when cash comes in handy, but we're also transitioning into a cashless society so that option will slowly be gone.

Do stores really need to be connected to the internet all the time?

[sofixa]

> This is when cash comes in handy, but we're also transitioning into a cashless society so that option will slowly be gone.

No, because giving money is only a part of the transaction.

> Do stores really need to be connected to the internet all the time?

Yes, they need to record transactions (in some cases live for tax purposes), update inventory, and in the case of a pharmacy also check medical files (if such a feature exists in the country in question), verify insurance information, check usage details on the specific drug, etc etc.

Some of those could be batched offline and verified when the connection is back up, but others can't.

[mrtksn]

In some places like Turkey, shops traditionally keep a "debt book" where customers will accumulate debt for their purchases and pay once they have the money. With the prevalent use of credit cards the tradition is much less widespread today of course but it is still used by people who become unbanked for one reason or another(i.e. people who are persecuted, people who went bankrupt and want to keep their transactions out of books).

So, no, loss of connection or system break down won't necessarily mean that the trade stops. People have many ways of issuing IOUs and they can go creative.

[batch12]

Yes, but they don't need to be able to communicate with the entire internet. A few routing and firewall rules would go a long way for most stores.

[itsoktocry]

>This is when cash comes in handy, but we're also transitioning into a cashless society so that option will slowly be gone.

Pharmacy IT infrastructure is a little more involved than the POS system at the checkout.

[viraptor]

For pharmacies? Yeah - stock, ordering, prescription validation, (country dependent) drug seekers checks, vaccination records, ...

It's not just payments.

[amatecha]

I dropped by an LD shop tonight hoping to purchase one item. The doors were locked, with signage that the stores were closed (I assumed they would have reopened by now). They had some staff on hand, mostly to pass along info to would-be customers and let pharmacy-goers in. The guy at the door said I can make an online order and pick it up. So I did so. The website said "available in under 30 minutes!", which was great! I wasn't getting the "item ready for pickup" email though, and eventually I went back and was told "we literally can't access the systems to handle the order", the ppl at the store are totally locked out of their online systems (I guess). Pretty dire. They will apparently start reopening stores in a "rotating" fashion, which is pretty surprising (especially for a company of this size). The guy had no clue when I'll be able to pick up my order.

[rob74]

> Retail and pharmacy chain London Drugs [...] has shuttered its stores across Western Canada until further notice.

> The chain says pharmacists would still support customers with urgent pharmacy needs [...]

Er... which one is it now? If they support customers with urgent pharmacy needs, the stores can't be completely shuttered?

Also, there is no information about any of this (including which stores are open and under what conditions) on their website - but maybe they also no longer control that website?

[throwawayk7h]

At the location I visited yesterday, somebody let me in because I wanted to go to the pharmacy, but they turned other people away. They gave me a few days' supply without charging me.

[kotaKat]

The last I remember LD was a Toshiba/IBM OS 4690 shop for their point of sale system. I don't think there would be compromise there, it's robust (enough) that I haven't seen (many) exploits on that platform.

The rest of the company network though (other servers, endpoints) could well be screwed as well as anything trying to hook to it.

[prmoustache]

> Er... which one is it now? If they support customers with urgent pharmacy needs, the stores can't be completely shuttered?

Customers can still go to another pharmacy.

[viraptor]

"support" doesn't necessarily mean they sell anything. I don't know about the system in Canada, but around here the pharmacy can hold your prescription repeats for example or other important information that you'd have to get before you can pick up your drugs from a different location. Or you may have local vaccination scheduled. Or other things that pharmacies do.

[dojitza1]

Reading between the lines it seems like it's some kind of ransomware.

[sharpshadow]

The attack was recognised on Sunday afternoon, so they chose to attack during the end of the weekend.

If all stores are incapable to service and apparently no customer data has been compromised, it could be ransomware.

[lenerdenator]

So, let's say I'm a diabetic who needs his insulin and was planning on picking it up today. What then?

Attacks on Western digital infrastructure will continue until the "technologically talented" in countries like Russia and China (among other places) start seeing it as a way to invite imminent danger into their lives.

[itsoktocry]

>So, let's say I'm a diabetic who needs his insulin and was planning on picking it up today. What then?

You go to your pharmacy and they'll give it to you and make a note for repayment. Or you go to one of the other 500 pharmacies in the Province.

[2OEH8eoCRo0]

Which threat actor is involved?

[pixl97]

Why? Predators do not select the finest cut of meat to eat, they select the easiest to capture and kill. You're just falling for the "Why would attackers go after me, I'm a nobody" fallacy. Those attackers cast a wide net.

[b112]

No, these miscreants and vile scum should go after no one, and instead, be jailed.

[lynx23]

Its not really a surprise that many commenters here seem to defend the relatively recent digital dependence. Kind of understandable, because most commenters here are working in tech, and obviously dont want to see problems like this. But this is asking the wolf how the sheep are supposed to be guarded... When I go to my pharmacy, the only reason why I need electricity there is to be able to pay with my watch. But that is a convenience. I always have cash in my pocket. Digital prescriptions are a very recent thing here where I live, basically since COVID. Before that, it was a simple piece of paper, and there was no validation that would require internet connectivity. But commenters here still seem to frame it as if the world would go down in flames if certain digital services were no longer available. Thats wrong, bordering on deliberately maniuplative. If a cyberattack can lead to a closed drug store, the problem is our reliance on digital, not the fact that the cyberattack happened.

[ta1243]

> When I go to my pharmacy, the only reason why I need electricity there is to be able to pay with my watch

No it's not. Things like fire safety systems, security systems etc all need electricity.

And you can pay with your watch on a battery powered offline device anyway.

The need is for everything else in the hyper-efficent supplychain.

[squigz]

One of the top comments in this thread is questioning whether a store needs to be connected all the time, and society's move to cashless. I also scrolled through the rest and couldn't find any that seemed to defend this "digital dependence"

Perhaps you could link to some?

[HeatrayEnjoyer]

Entirely agreed but they still must query the national database of filled scripts (to prevent dr shopping e.g. opiate abuse) and that requires at least a phone line.

[macintux]

Computers make it possible to have the convenience of massive retail establishments with large inventories and a reasonable hope of finding what we want when we want it.

[newsclues]

Canada cybersecurity is bad. Recently the Toronto Public Library got hacked.

And our government is worried about online harms haha

[rchaud]

You're using 2 examples of hacks to reach a conclusion about the state of cyber security across an entire country?