LockBit Ransomware Demands $25 Million from London Drugs

LockBit ransomware has assumed responsibility for the attack at London Drugs, a Canadian retail pharmacy chain, and now demands a ransom payment of $25 million to prevent the release of stolen data.

This development follows a previous report by Cyber Insider indicating that London Drugs was investigating a potential customer data breach, while also striving to restore online payment and other services availability.

Threat monitoring service H4ckManac published the claim on Twitter, with LockBit claiming that London Drugs was negotiating a payment of $8,000,000.

🚨 Major #CyberAttack 🚨

🇨🇦#Canada: LockBit ransomware group, demands $25,000,000 from London Drugs, threatening to release stolen data.

The breach on April 28 led to the temporary closure of 79 stores.

Despite an alleged offer of $8 million, London Drugs refuses to pay.… pic.twitter.com/G0ZdtYDFuG

— HackManac (@H4ckManac) May 22, 2024

London Drugs, based in Richmond, British Columbia, operates 78 stores across British Columbia, Alberta, Saskatchewan, and Manitoba. The data compromised in this breach potentially includes customer and operational data from these locations, but LockBit hasn’t published any samples yet.

Although the current announcement no longer shows the ransom amount message, it sets a deadline for data release, giving London Drugs only a couple of hours at this point to comply.

LockBit is notorious for its aggressive ransomware campaigns, having targeted various high-profile organizations globally in the past years. Although the ransomware operation was disrupted by a law enforcement earlier this month, and the authorities also revealed the identity of its leader, attacks against firms appear to continue unabated for now.

London Drugs hasn’t responded to LockBit’s claims and neither have they released a statement about the situation or the safety of their clients’ data, so whether or not the cybercriminals make valid claims remains to be seen.

Meanwhile, customers of the chain are recommended to treat all incoming communications with vigilance, avoid sharing information over the internet, and report suspicious activity on their accounts to the appropriate parties.

Regarding the status of operations at London Drugs, some pharmacy locations have reopened and are working normally, but many still remain impacted by the cyberattack despite three weeks having passed. Also, the chain is currently working with a backlog of prescriptions due to the recent disruption, so processing times may take longer than usual.