London Drugs cyberattack shows need for companies to have insurance

Article content

Large companies such as London Drugs should have cyberattack insurance in place so they can defray any costs, including wages owed to employees, when stores have to close temporarily, according to a legal expert.

“Realistically, what is reasonable for a company the size of London Drugs is to have insurance in place for these kinds of events,” said Lluc Cerda, managing partner and lead for employment and labour law in Western Canada at Samfiru Tumarkin.

Article content

Article content

He said that qualifying for this kind of insurance requires that companies beef up security measures to prevent cyberattacks happening in the first place.

His comments come after London Drugs said on Monday it reopened more than half of its 79 stores following a cyberattack that forced the chain to close for more than a week. In a statement, the company said it expected that the remaining stores will open by the end of day on Tuesday.

Responding to queries from Postmedia, the company said during store closures employees were offered the opportunity to continue working, focusing on merchandising, stocking shelves, cleaning, or supporting efforts to reopen stores. It said for those who preferred not to come into closed stores, it offered the option of using vacation pay in place of working a scheduled shift.

“All employees received their paycheques as scheduled, and will continue to do so,” it said.

Cerda said that having cyberattack insurance could help companies to pay employees during a forced leave of absence such as this so they wouldn’t have to use vacation or banked overtime pay. However, there is no way an employee can force an employer to do this. Also, an employer can’t force an employee to accept going days or weeks on end without work.

Article content

Article content

“We do sometimes see employers asking people to use banked vacation and overtime so they can continue to be paid even though they’re not working. We sometimes see employees being laid off during these downturns resulting from a cyberattack,” he said.

He said having employees use their vacation or banked overtime pay is a “middle ground” in the sense that employees can continue paying their own expenses, but then they lose their vacation time later on. The alternative is laying off employees, but that can be a breach of an employment contract and the duty to provide work and compensation for it.

Companies that get hit by cyberattacks can face costs in the tens of millions of dollars to address the fallout of a technical issue, as well as lost sales. They may also face penalties for having to delay accepting merchandise from suppliers or not being able to pay invoices, which would also involve breaches of contract that could be contested in court.

In some instances, a cyberattack can result in needing more employees or hours, such as when self-checkout kiosks go down, which is what happened at national grocery retailer Empire Co. stores, including Safeway, Sobeys, IGA, FreshCo, and Thrifty Foods, among others, in Fall 2022.

Article content

Even though insurance for cyberattacks is worth having, companies have to protect against many other unforeseen events too.

“Today, it’s a cyberattack. Tomorrow, it’s a rail strike. The next day, a pandemic. The actual event changes, but unforeseen events, the specifics are unforeseen, but that they will happen is very foreseeable. So it’s good to have a policy in place on what happens when a store is forced to close, for a snowstorm, whatever it is,” said Cerda.

A strong policy would define using paid leaves of absence. It could also look at longer stretches and include details on work-sharing or work-from-home agreements, or using backup computer systems and locations.

jlee-young@postmedia.com

Bookmark our website and support our journalism: Don’t miss the news you need to know — add VancouverSun.com and TheProvince.com to your bookmarks and sign up for our newsletters here.

You can also support our journalism by becoming a digital subscriber: For just $14 a month, you can get unlimited access to The Vancouver Sun, The Province, National Post and 13 other Canadian news sites. Support us by subscribing today: The Vancouver Sun | The Province.

Article content