General Questions
Is your online inventory up to date?
Our team is working hard to bring back the online experience you love and expect from Indigo. Please note that online inventory is in the process of being updated and may not accurately reflect what is currently available in store. Please call your local store to ensure a specific product is in stock and available for purchase.
What happened with your website and why was it temporarily unavailable?
On February 8, 2023, Indigo experienced a ransomware attack. We immediately engaged third-party experts to investigate and resolve the situation. As part of this remediation work, we proactively shut down some of our systems to prevent data from being improperly accessed, and have been working with third-party experts to strengthen our cybersecurity practices, enhance data security measures, and review our existing controls.
There is no reason to believe customer data has been improperly accessed, but we know that some employee data was.
Through the investigation, we learned Indigo’s network was illegally accessed by criminals who deployed ransomware software known as “LockBit”. Although we do not know the identity of the criminals, some criminal groups using LockBit are affiliated with Russian organized crime. We are continuing to work closely with the Canadian police services and the FBI in the United States in response to the attack.
Has my credit card, debit card, or gift card balance been compromised?
Customer credit and debit card information was not compromised. We do not store full credit card or debit card numbers in our systems. Gift card balances also remain unaffected
Has my personal information been compromised?
At this time, we can share that our investigation has found no indication that customer data was compromised. The security and integrity of your data is our top priority. If at any point in the future we determine that personal data has been compromised, we commit to contacting those impacted directly.
What type of information was affected?
While we can share that our investigation has found no indication that customer data was compromised, our investigation found that some employee data was. We have notified all affected employees. We have also notified, and are cooperating with, law enforcement.
How are you helping those who have been affected?
At Indigo, our staff are at the very heart of our organization, and we take their privacy and security seriously. We deeply regret this incident and are committed to ensuring employees have the support they need.
We notified, and are cooperating, with law enforcement. To provide additional assurance and protection to all affected employees, we have retained the assistance of TransUnion of Canada, Inc., one of Canada’s leading consumer reporting agencies, to offer two years of myTrueIdentity credit monitoring and identity theft protection services at no cost.
Are former employees also affected? Are you reaching out to them to provide them with protection?
Both current and former employees were notified that their information may have been impacted. To provide additional assurance and protection to all affected employees, we have retained the assistance of TransUnion of Canada, Inc., one of Canada’s leading consumer reporting agencies, to offer two years of myTrueIdentity credit monitoring and identity theft protection services at no cost.
Online Orders
I placed an order via’s Indigo temporary site and require assistance. Who should I contact?
If you placed an order after Feb. 21 on our temporary site and your order number begins with #IDG, please email a customer service representative at questions@indigo.ca for assistance.
I placed an order for in-store pickup. When can I pick it up?
If you have received your Ready for Pickup email, you can come to the store. If you have not received this confirmation, unfortunately there is a delay, which we are working to resolve as quickly as possible. When your order is ready for pickup, you will receive an email.
Can I place a new order for in-store pickup?
Yes, we are offering our ship-to-store option, and same-day pickup in select stores. If your local store offers same-day pickup, the date in checkout will reflect that.
If I have a discount code, can I use it online?
We are happy to share that we are accepting valid discount codes for online orders.
In Store
Are your stores open?
Our stores are open across the country, and we’re excited to see you!
Do you accept credit cards and gift cards in store?
Yes, in store we accept cash, debit, credit, and gift card transactions.
Am I able to make an exchange or return in store?
Yes, please visit a store near you for assistance with your exchange or return.
Will I receive a receipt for my purchase in store?
Yes, all purchases will be accompanied by a receipt.
I placed an order for in-store pickup. When can I pick it up?
If you have received your Ready for Pickup email, you can come to the store. If you have not received this confirmation, unfortunately there is a delay, which we are working to resolve as quickly as possible. When your order is ready for pickup, you will receive an email.
Exchanges or Returns
Am I able to make an exchange or return in store?
Yes, please visit a store near you for assistance with your exchange or return.
I have mailed in a return. How will I know if it is being processed?
We apologize for the delay you may be experiencing with your return. We are working hard to process all returns as quickly as possible, but there may be a short delay. You will receive an email confirmation once your refund is processed. For any questions, please contact customer service. Visit help.indigo.ca for options to reach us.
plum & plum PLUS
Have my plum points been impacted?
Customer plum points remain intact and unaffected by the cybersecurity incident.
Will I receive my plum PLUS discount?
Yes. You will receive your plum PLUS discount when shopping in store and online Please log in to your plum PLUS account online using the email address you registered with.
Will the plum & plum PLUS birthday discount be honoured?
We want to celebrate you! Members celebrating a birthday in February or March were provided a new birthday coupon via email by March 31, 2023, which can be used in store or online by the end of April 2023.
Can I join the plum PLUS program?
Yes! We are happy to process new and renewing memberships. Your “Welcome to plum PLUS” email, which will include your plum PLUS bonus offer, will be emailed to you within the first month of your membership.
Can I renew my plum PLUS membership?
Yes! As a valued plum PLUS member, you are now eligible to renew your membership. All plum PLUS memberships have been extended by one month from the current expiry date. We will send the current plum PLUS renewal offer to your email by the end of April.
Do my plum points expire?
plum points expire if you don’t make a qualifying purchase within 12 months.
For Employees – Current & Former
Did you pay the ransom?
No. The privacy commissioners do not believe that paying a ransom protects those whose data has been stolen, as there is no way to guarantee the deletion/protection of the data once the ransom is paid. Both US and Canadian law enforcement discourage organizations from paying a ransom as it rewards criminal activity and encourages others to engage in this activity.
Additionally, we cannot be assured that any ransom payment would not end up in the hands of terrorists or others on sanctions lists.
What information was affected?
Some employee information including: name, email address, phone number, birth date, home address, postal code, social insurance number as well as employee direct deposit information including name of financial institution, bank account number, and branch number may have been impacted. Please review the communication you have received or will receive from TransUnion for additional detail regarding your personal situation.
A small number of current and former employees may also have received a supplementary communication from Indigo notifying them that additional information was affected. This includes documentation related to immigration applications and status or information related to certain internal HR processes, such as workplace investigations or medical leaves. All those affected were contacted directly via email or physical mail and advised of the specific information affected. If you received notice and have follow up questions about the information, please reach out to support-hr@indigo.ca. For any employee who may have had their information affected, we strongly encourage the use of myTrueIdentity services and to activate the Dark Web monitoring service.
Has my information been posted to the dark web?
We were informed that the criminals responsible for this attack intended to make some, or all of, the data they stole available on the dark web as early as Thursday, March 2, 2023. We are continuing to work closely with the Canadian police services and the FBI in the United States in response to the attack.
How and when will I be receiving information from TransUnion regarding the cybersecurity incident?
TransUnion began contacting current and former employees directly as of 5 p.m. ET on Feb. 23, 2023 via email using the last personal email address on file with Indigo. For current employees, this email address is reflected in their UKG profile. Please note that the sender of the email is Cyberscout (a TransUnion company) and the subject line is Cybersecurity Incident Notification. For those who do not have a personal email address on file, they would have received the letter via regular mail to their address on file with Indigo, which for current employees is reflected in their UKG profile.
Who sent the email, and how do I know it’s safe?
The email sender appears as “Indigo” and the sender email address is Cyberscout. Cyberscout is a TransUnion company assisting with the delivery of your personal TransUnion code.
I am a former employee. Was I affected?
If you were a former employee who ceased to work for Indigo prior to 2015, you were not affected by this incident. Your personal information was not part of the data that was affected. Since you were not affected, you will not be receiving a letter or email with an offer of credit monitoring. Some former employees who were employed at Indigo on or after January 1, 2015 may have been affected by this incident. If you were employed at Indigo on or after January 1, 2015 and you were affected, you will receive an email or letter with an offer of credit monitoring. If you have not received your email or letter by March 6, 2023, you may contact us at support-hr@indigo.ca to verify whether you were affected.
How will you be contacting former employees whose data was impacted?
Former employees were reached out to via email or postal address depending on what we have on file.