Malicious code embedded on LCBO site, customer data may be compromised
Posted January 12, 2023 1:49 pm.
Last Updated January 12, 2023 6:07 pm.
The Liquor Control Board of Ontario (LCBO) says an unauthorized party embedded “malicious code” on its website to obtain customer information, and personal data may have been compromised.
The provincial Crown corporation had said Wednesday that it was investigating a cybersecurity incident that knocked out its website and mobile app — both are now operating again.
In a statement Thursday, the LCBO says customers who provided personal information on check-out pages on its website and proceeded to its payment page between Jan. 5 and Jan. 10 may have had their information compromised.
It says that could include names, email and mailing addresses, and credit card information.
“We are continuing our investigation into the incident to identify the specific customers impacted so that we can communicate with them directly,” the LCBO says in a statement.
However, it recommends everyone who started or completed payment for orders on LCBO.com during the affected time period to monitor credit card statements for suspicious transactions.
Orders placed through the LCBO mobile app or vintagesshoponline.com were not affected.
“With a thorough review and testing of the website complete, including enhanced security and monitoring measures in place, LCBO.com and our mobile app have been restored and are fully operational. We have also reset all LCBO.com account passwords. Registered customers will be prompted to reset their password on login.”
Related: Concerns growing over spike in cybersecurity incidents in Canada
This particular incident comes after SickKids hospital experienced a ransomware attack in December that affected several critical hospital systems. The hospital has since restored about 80 per cent of its priority systems.
