Data breach reference · February 2023

The Indigo Books data breach

What was disclosed, and how to check whether your address was in it.

At a glance
Disclosed
8 February 2023
Records
60,000 (Office of the Privacy Commissioner of Canada)
Type
Ransomware
Sector
General

Check whether your address was in it

No account needed. The address is used only to run the check. Privacy

This disclosure

What is on the record.

60,000
Records reported in the disclosure
1,347 days
Since the disclosure, 8 Feb 2023

Source: Office of the Privacy Commissioner of Canada, as recorded in the LeakTrace tracker.

What happened

Indigo disclosed a ransomware attack in February 2023 that brought down its e-commerce platform for weeks and disrupted in-store payment card processing at more than 200 locations. The threat actor later published stolen data on the dark web after Indigo refused to pay the ransom.

Personal information belonging to current and former employees was among the leaked data, including names, dates of birth, Social Insurance Numbers, and direct-deposit banking details. Indigo provided affected employees with credit-monitoring and identity-theft protection services.

Reported impact: Estimated $60M CAD revenue impact

Source: Office of the Privacy Commissioner of Canada, 8 Feb 2023.

What to do if you were affected

  1. If you are a current or former Indigo employee, monitor your credit file closely.
  2. Place a fraud alert with Equifax and TransUnion.
  3. Change your Indigo account password if you have one.
  4. Watch bank statements for unauthorized transactions.
  5. Enable two-factor authentication on any account tied to your Indigo email.

Common questions

When was the Indigo Books breach disclosed?
In February 2023. Public reporting was carried by Office of the Privacy Commissioner of Canada.
How many people were affected?
60,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with Indigo Books at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it, and not reusing it, closes that door.

Other breaches in this sector

Dodo PizzaSep 2026 · 68,000,000 recordsTicketmasterMay 2024 · 560,000,000 recordsLondon DrugsApr 2024 · 3,000,000 recordsSnowflake customer credential-stuffing: AT&T 73M recordsApr 2024 · 73,000,000 records

Is your address in a public breach? Check my address →