Sobeys parent Empire sizes up financial hit from cyberattack

Canadian food and drug retailer Empire Company Ltd., parent of Sobeys, took a hit in its fiscal 2023 third quarter as a cybersecurity incident late last year impacted its bottom line by potentially more than $50 million Canadian dollars—about $36.4 million in U.S. currency.

Stellarton, Nova Scotia-based Empire said a “cybersecurity event” affected some of its IT systems on Nov. 4 and, combined with the company’s precautionary response, caused some temporary issues. For example, pharmacy services were shut down for four days, some products were unavailable and some in-store services—including self-checkout, gift cards and redemption of rewards points—were affected for about a week.

Empire didn’t disclose the type of security breach and whether customer data had been exposed, but some published reports said the incident might have been a ransomware attack. The company, though, noted that it was able to operate its retail network with “little to no disruption” to its supply chain, and customers “noticed very few changes to their normal shopping experience.”

Preventive measures taken by Empire and cyber defense firms included proactively shutting down certain systems as well as bolstering existing security monitoring, scanning and protective measures, according to the company. Workaround processes also were put in place to maintain supply, costing and retail pricing continuity. Empire said it brought information and administrative systems back online in a “controlled, phased approach” and continues to investigate the cybersecurity incident.

Empire CEO Michael Medline said the company has "fully returned to business." / Photo courtesy of Empire Company Ltd.

“These cyberattacks are a nasty piece of business. I wouldn’t wish them on my worst enemy,” Empire President and CEO Michael Medline told analysts in a conference call Thursday on third-quarter results. “Throughout this event, our priority was to do the right thing for our customers, our employees and our business. However, this event had several one-time impacts on our Q3 performance and results. I am pleased to say that we’re over it now and have fully returned to business as usual in Q4.” (Call transcript provided by AlphaSense.)

Looking at the bottom line

For the fiscal 2023 quarter ended Feb. 4, net earnings came in at $125.7 million (Canadian), or 49 cents per diluted share, down from $203.4 million, or 77 cents per diluted share, a year earlier. Adjusted net earnings, excluding the cybersecurity event, were $164.8 million, or 64 cents per diluted share.

Empire estimated the cyberattack’s impact on Q3 net income, including incremental direct costs and inventory shrink, at $39.1 million, net of insurance recoveries to date. Sales decreases and operational impact related to the incident also weren’t reflected in Q3 earnings and are estimated at $15 million or more, the company said. These include the temporary loss of advanced planning, promotion and fresh-item management tools, temporary closures of pharmacies and customers’
inability to redeem gift cards and loyalty points.

The cybersecurity incident occurred just before the end of the second quarter and, initially, Empire estimated the impact on fiscal 2023 net income at $25 million. However, Chief Financial Officer Matt Reindel told analysts that figure is now pegged at $32 million, net of insurance recoveries.

“Since Q2, we have a more complete understanding of the impact of the cyber event and the process to make insurance claims. Our estimate for Q2 was close, but we’ve increased the amount by $7 million to reflect some additional direct costs and a little more strength than we had initially estimated. We now expect that the total impact on net earnings will be approximately $32 million, which will be reflected across both fiscal 2023 and fiscal 2024,” Reindel explained. “The vast majority of the costs will be incurred in fiscal 2023. But we now believe that our insurance claims may take longer to process, and these recoveries will occur in both fiscal 2023 and fiscal 2024. It’s important to repeat that we only had minimal insurance recoveries in Q3.”

The Canadian grocer hit its target of opening 31 new FreshCo discount food stores by the end of fiscal 2023. / Photo: Shutterstock

Inflation, cyberattack impact sales

At the top line in the third quarter, Empire totaled sales of $7.49 billion (Canadian), up 1.5% from $7.38 billion a year ago. Same-store sales edged up 0.6% year over year and 0.1% excluding fuel.

“From a sales growth perspective, it was a challenging quarter. While the cyber event had a temporary negative impact on our same-store sales, our sales growth was also impacted by the stubbornly high level of inflation and the associated change in consumer purchasing behavior towards value discounts, plus the fact that we were lapping elevated Omicron [COVID-19] sales last year,” Reindel said. “Having said that, now five weeks into Q4, we are seeing sales momentum pick back up and expect stronger sales growth in our last quarter of fiscal 2023.”

Strategic plans proceed

According to Medline, Empire has made big strides in Project Horizon growth plan, including the expansion of its retail footprint. He said that, in February, the company achieved its goal to open 31 new FreshCo stores by the end of fiscal 2023, and the discount grocery banner now has 44 locations in Western Canada. In December 2017, Empire had unveiled plans to convert underperforming Safeway and Sobeys supermarkets in Western Canada—or about 25% of the banners’ 255 locations in the region—to FreshCo outlets under a five-year program, which ended up being disrupted by the pandemic but is back on course.

Empire also has moved ahead with the integration of Longo’s, the Ontario grocer it in which it acquired a majority stake in May 2021. This month, Empire started rolling out 230 non-food own-brand products at Longo’s stores, and in July the company plans to begin integrating Longo’s Grocery Gateway e-commerce service into Empire’s Voilà online grocery service, Medline said.

The third Ocado-powered customer fulfillment center for Sobeys' Voilà grocery delivery service is set to open in early fiscal 2024. / Photo: Shutterstock

For Voilà, Empire continues to build out its network of four Ocado-automated customer fulfillment centers (CFCs) across Canada. The first CFC in Toronto began deliveries in June 2020, and the second CFC in Montreal launched deliveries last March under a phased transition of customers to Voilà par IGA from IGA.net. Construction of third CFC in Calgary, Alberta, is winding down and slated to start deliveries in early fiscal 2024. The fourth CFC, to be situated in Vancouver, British Columbia, is expected to initiate deliveries in calendar 2025.

“Similar to the IGA.net transition, Grocery Gateway customers will transition to Voilà over a six-week period, offering Longo’s as a significant shop-in-shop on the Voilà platform,” Medline said in the call. “We also remain on track for CFC three to open in Calgary in the first quarter of fiscal 2024 and are excited to be bringing our world-class e-commerce grocery business to the Alberta market to serve our customers.”

This week, Empire also expects to complete the rollout of its Scene loyalty program, which replaced Air Miles. Scene made its debut in August at supermarkets in Atlantic Canada, followed by Western Canada stores in September and Ontario locations in November.

“We will be launching Scene in Quebec and in our Thrifty Foods banner in British Columbia, which is the fourth and final regional launch,” Medline said. “We have been working closely with our Quebec franchisees and Thrifty store managers to prepare, leveraging the learnings from our past rollouts.”

Empire’s food retail network, operated via its Sobeys Inc. subsidiary, includes over 1,900 food, drug and convenience stores in all 10 provinces under such banners as Sobeys, Safeway, IGA, Foodland, FreshCo, Thrifty Foods, Farm Boy, Longo’s and Lawtons Drugs.