The book retailer said its investigation showed criminals used software known as LockBit—typically used by criminal groups in or affiliated with Russia—on Feb. 8 and accessed some current and former employees’ personal data that the culprits may release on the dark web as early as today. (The Logic)

Talking point: “The privacy commissioners do not believe that paying a ransom protects those whose data has been stolen, as there is no way to guarantee the deletion/protection of the data once the ransom is paid,” the company said. It noted Canadian and U.S. law enforcement also discourage ransom payments as they reward criminal activity and can encourage copycats. The attack resulted in Indigo’s website going offline and it being unable to accept in-store payments besides cash. It was able to accept debit, credit and gift cards at stores Feb. 13, and launched a browse-only website 10 days into the outage. Customers can now shop for some books online. Meanwhile, the White House said in its National Cyber Strategy that it wants to shift the burden of cybersecurity onto software makers.