Inside the chaos at a Sobeys-owned store after ransomware attack

Employees at Empire Co., Sobeys’ parent company, began speaking out about the chaos unfolding within the grocery chain since a ransomware attack began plaguing its computer systems earlier this month.

Employees across the country said some stores were running out of items because they couldn’t place orders as usual, while others were initially piling up with spoiled food or frozen because they couldn’t be removed from their inventory systems. There is also

The pharmacy cannot create new prescriptions for a week and customers cannot redeem loyalty points or redeem gift cards. Staff were worried last week that they would not get paid because the payroll system was down.

“Basically, it was a mess…the best word for it is just a mess,” said one front-end employee at Safeway in Western Canada.

The CBC has agreed to protect the identities of the employees who spoke because it fears they will be fired if the company finds out they shared inside information.

ransom message on computer

empire Announced in a news release dated November 7 An “information technology system problem” had disrupted some services, such as filling prescriptions at pharmacies. He said stores are still facing challenges, but pharmacies are fully operational again.

The company owns 1,500 stores across Canada, including Sobeys, Lawtons, IGA, Safeway, Foodland, Needs and other grocery stores.

Some cybersecurity experts Company system hackedand ransomware attacks (attacks in which hackers lock computer systems until money is paid).

Employees who spoke with CBC said ransomware was indeed the cause of the problem.

“Someone in upper management got the email and basically clicked on a link that wasn’t supposed to,” said a Safeway front-end employee. “I don’t know the exact amount, but I know it was millions, millions of dollars.”

Trouble started on the night of Thursday, November 3rd through Friday, November 4th.

When the employee showed up for work on Friday, the computer took longer than usual to boot, and when it finally did, nothing appeared except this big white block in the middle of the screen that said Ransomware. Please comply before proceeding, or something like that,” said an employee of the Safeway store’s meat and seafood division.

“When I saw the word ransom, I immediately got scared.”

Order on the whim of the warehouse

Employees were told not to log in, unplug certain digital scales, and use scanning equipment that could track inventory.

Without a computer system and a handheld scanner called a Telxon gun, stores can’t place orders, and in some cases, run out of certain items.

After the first day or so of the shutdown, warehouses began sending goods to stores based on what they had in stock and estimates of what they needed.

“What the warehouse wants us to send is hit and miss,” said one employee. “So we’re getting all sorts of weird stuff that we haven’t seen in decades.”

Since some stores have not taken orders for an item and others have orders, an employee at one store drives to another store to pick up the item they need.

In some stores, staff write price symbols by hand because the system they normally use is not available.

“When we finally got the system back, everything was going to go very wrong because nothing was scanned,” the employee said.

Scheduling and payroll

Computer problems also disrupted Empire’s ability to maintain its normal scheduling and payroll system.

“I literally went to work and had something like a schedule written down on a piece of paper. What is this?” said the worker.

Some employees are asked to record their working hours in a diary.

Chain employees are paid bi-weekly and were told last week that they would not be paid on their scheduled payday, last Thursday.

However, workers later told the CBC that the company had found a workaround. Since the first week of the two-week pay period occurred before the ransomware attack, employees will receive the same amount of wages in the second week even if they are not working. same number of hours. Also, each employee received an extra $100 on Thursday, compensating him for the extra hours he may have worked during the second week.

Overpaid workers are expected to return their overpayments once the payroll system is operational again.

Customer impact

Many customers may be unaware of the issues their employees face. However, some implications are clear.

On the first day of the blackout, some automatic payment machines were not working.

“The line at the checkout. People are not used to it and we send a lot of people into self checkout, so a lot of our customers are upset about it,” said a Safeway employee. rice field.

Customers can’t use gift cards or redeem Scene loyalty points, stores can’t process Western Union money transfers, and some employees are frustrated, one employee said. I’m here.

The company has not officially told its employees what caused the suspension. I’ve been instructed to tell the customer it’s an IT issue.

“It makes me sick to have to tell customers what’s really going on,” said one employee. “I feel like I’m trying to fool everyone because there’s more going on behind the door than they’re trying to do.”

food security concerns

Sylvain Charlevoix, director of the Institute for Agro-Food Analysis at Dalhousie University, said he had noticed many empty shelves at the Sobeys-owned store since the computer problems began.

But so far Canadians don’t seem to be particularly concerned about the issue, he said.

“If the situation gets worse, at some point people will realize how important it is for ransomware to hit the food industry,” he said. “This is the second grocery store in the country to deal with cyber terrorism. It’s a big deal.”

Hacking is a privacy concern because the company holds personal data through credit and debit cards, loyalty programs, and pharmacy prescriptions.

But this disruption is also critical from a food security perspective. Because the food retail industry is a high-volume, low-margin industry, a heavy hit from a ransomware attack could bring down an entire company, he said.

This means that parts of the food distribution system may cease to function, causing food prices to rise, at least temporarily.

“I believe in the food industry. They will readjust and reopen, but it will take some time,” Charlevoix said.

“Cybersecurity is certainly a huge vulnerability in our supply chain, especially when it comes to food. Ransomware is always a problem when we see access to food in Canada.”