Coles Group is investigating a cyber security incident, it told the ASX at 8.26am on Monday 16 November. "Based on the findings of our investigation to date, we have not identified any evidence that customer, team or supplier data has been compromised or removed from Coles' systems," the supermarket group said in its release.
Coles is working with the Australian Cyber Security Centre and "will continue to engage with appropriate agencies and regulators as investigations continue", the release says. It is also working with global cyber security experts "to contain and secure the Coles IT environment". Operations continue, it says, and "customers are able to shop as normal with Coles in stores and online".
The company apologised "for any concerns this may cause our customers and key stakeholders at a time of increasing cyber incidents in Australia and around the world". The Board authorised the release.
What Coles has not said
The release does not say what kind of incident it is, when it started or when Coles found it. It does not say which systems or which part of the business are involved. No executive is quoted. The ABC's markets blog called it "a pretty vague first announcement, with no details of which part of the business has been compromised". Coles says further updates will come through its website.
What it means for shoppers
Coles has put up an updates page with questions and answers for customers. It shows no date. When we read it on Monday morning it said the Coles app and website can be used as normal and "there is no action you need to take at this time". Coles says it has "no indication that Flybuys accounts have been impacted", that gift cards "continue to work as normal" and that "no issues have been identified with Coles Plus, Coles Plus Delivery or QuiteLike subscriptions".
The answer on the app and website adds one problem. "We are aware of a small number of customers experiencing issues with Liquorland click-and-collect, and we are investigating." Coles does not say whether that is linked to the incident.
On passwords, Coles recommends "a strong, unique password" and not reusing one password across services. It asks customers to be cautious with unexpected emails and text messages, and says Coles "will never ask you to provide your password or other sensitive account information" through an unsolicited email or SMS.
What it means for staff and suppliers
Coles employs more than 115,000 team members, according to its website. The release says the investigation has found no evidence that team data was compromised or removed. The updates page has questions and answers for customers and for suppliers, with none for team members.
The supplier questions and answers carry the same advice on "remaining vigilant to suspicious links".
Coles and Latitude in 2023
In April 2023 Coles said in a media release that Latitude, a former service provider, had told Coles Financial Services that "historical Coles Credit Card holder data has been affected" by the cyber incident at Latitude. Coles Financial Services had moved its credit cards to Citibank in March 2018, the release said.
What we don't know
The finding on data covers Coles' investigation "to date". Coles has not said when it expects to finish or when the next update is due. We don't know what Coles has told its own staff.
If something in this story is wrong, tell us through our corrections form.
