Coles Group has told the market it is investigating a cyber security incident, with early findings indicating no customer, team or supplier data has been taken.
In an announcement authorised for release by the Coles Group board and lodged with the Australian Securities Exchange this morning, the company said it “is currently investigating a cyber security incident”. It added that, “based on the findings of our investigation to date, we have not identified any evidence that customer, team or supplier data has been compromised or removed from Coles’ systems”.
The retailer said it is working with the Australian Cyber Security Centre (ACSC) and “will continue to engage with appropriate agencies and regulators as investigations continue”. It has also engaged what it described as “global cyber security experts to contain and secure the Coles IT environment”.
Coles said trading has been unaffected. “Operations continue and customers are able to shop as normal with Coles in stores and online,” the announcement said.
Read next: Shadow AI risk widens as governance frameworks lag behind
The company apologised “for any concerns this may cause our customers and key stakeholders at a time of increasing cyber incidents in Australia and around the world”, and said further updates would be published through the Coles Group website.
The announcement does not identify the attack vector, the systems affected, or any threat actor, and makes no reference to ransomware or an extortion demand. For brokers and cyber underwriters, the disclosure is notable less for what it confirms than for what it could signal about response sequencing.
Read next: Australian employers warned over hidden risk of Friday 13th Microsoft outage
A notification of this kind typically activates incident response cover well before any data loss is established – forensic investigation, legal advice, regulator liaison and containment work all generate cost regardless of whether personal information is ultimately found to have been exfiltrated. Coles has not disclosed whether it holds cyber cover or whether insurers have been notified.
The engagement of the ACSC and the reference to continuing regulatory engagement also leave open whether obligations under the Notifiable Data Breaches scheme will ultimately be triggered.
