General Questions
Is your online inventory up to date?
Our team is working hard to bring back the online experience you love and expect from Indigo. Please note that online inventory is in the process of being updated and may not accurately reflect what is currently available in store. Please call your local store to ensure a specific product is in stock and available for purchase.
What happened with your website and why was it temporarily unavailable?
On February 8, 2023, Indigo experienced a ransomware attack. We immediately engaged third-party experts to investigate and resolve the situation. As part of this remediation work, we proactively shut down some of our systems to prevent data from being improperly accessed, and have been working with third-party experts to strengthen our cybersecurity practices, enhance data security measures, and review our existing controls.
There is no reason to believe customer data has been improperly accessed, but we now know that some employee data was.
Through the investigation, we learned Indigo’s network was illegally accessed by criminals who deployed ransomware software known as “LockBit”. Although we do not know the identity of the criminals, some criminal groups using LockBit are affiliated with Russian organized crime. We are continuing to work closely with the Canadian police services and the FBI in the United States in response to the attack.
Has my credit card, debit card, or gift card balance been compromised?
Customer credit and debit card information was not compromised. We do not store full credit card or debit card numbers in our systems. Gift card balances also remain unaffected
Has my personal information been compromised?
At this time, we can share that our investigation has found no indication that customer data was compromised. The security and integrity of your data is our top priority. If at any point in the future we determine that personal data has been compromised, we commit to contacting those impacted directly.
What type of information was affected?
While we can share that our investigation has found no indication that customer data was compromised, our investigation found that some employee data was. We are notifying all affected employees. We have also notified, and are cooperating with, law enforcement.
How are you helping those who have been affected?
At Indigo, our staff are at the very heart of our organization, and we take their privacy and security seriously. We deeply regret this incident and are committed to ensuring employees have the support they need.
We have notified, and are cooperating, with law enforcement. To provide additional assurance and protection to all affected employees, we have retained the assistance of TransUnion of Canada, Inc., one of Canada’s leading consumer reporting agencies, to offer two years of myTrueIdentity credit monitoring and identity theft protection services at no cost.
Are former employees also affected? Are you reaching out to them to provide them with protection?
Both current and former employees are being notified that their information may have been impacted. To provide additional assurance and protection to all affected employees, we have retained the assistance of TransUnion of Canada, Inc., one of Canada’s leading consumer reporting agencies, to offer two years of myTrueIdentity credit monitoring and identity theft protection services at no cost.
Online Orders
Can I place an online order?
We are happy to share that we are now accepting online orders for all available products.
I have a new charge from Indigo but didn’t recently place an order. What is it for?
We are in the process of reconciling orders that were shipped or collected from stores during our service outage. If you have any questions about these charges, please reach out to customer service. Visit help.indigo.ca for options to reach us.
I placed an online order or pre-order for home delivery prior to February 8. When will it arrive?
At this time, we are unable to provide order status updates or estimated delivery timelines. We apologize for the delay you may be experiencing with all, or part, of your order. We are diligently working with third-party experts to resolve this as quickly as possible. Please contact customer service. Visit help.indigo.ca for options to reach us.
Can I cancel an online order I placed before February 8?
Yes. Please visit the My Orders page to cancel an existing order. If you checked out as a guest, please contact customer service for help with your order cancellation. Visit help.indigo.ca for options to reach us.
I placed an order after February 21 and require assistance. Who should I contact?
If you placed an order after Feb. 21 on our temporary site and your order number begins with #IDG, please email a customer service representative at questions@indigo.ca for assistance.
I placed an order for in-store pickup. When can I pick it up?
If you have received your Ready for Pickup email, you can come to the store. If you have not received this confirmation, unfortunately there is a delay, which we are working to resolve as quickly as possible. When your order is ready for pickup, you will receive an email.
Can I place a new order for in-store pickup?
Yes, we are offering our ship-to-store option. However, at this time, we are unable to offer same-day pickup in store. If you need to pick up an item the same day, please call your local store ahead of time to ensure the product you are looking to purchase is available.
If I have a discount code, can I use it online?
We are happy to share that we are now accepting valid discount codes for online orders.
In Store
Are your stores open?
Our stores are open across the country, and we’re excited to see you!
Are you accepting credit cards and gift cards in store?
Yes, in store we are accepting cash, debit, credit, and gift card transactions.
Am I able to make an exchange or return in store?
Yes, please visit a store near you for assistance with your exchange or return.
Will I receive a receipt for my purchase in store?
Yes, all purchases will be accompanied by a receipt.
I placed an order for in-store pickup. When can I pick it up?
If you have received your Ready for Pickup email, you can come to the store. If you have not received this confirmation, unfortunately there is a delay, which we are working to resolve as quickly as possible. When your order is ready for pickup, you will receive an email.
Exchanges or Returns
Am I able to make an exchange or return in store?
Yes, please visit a store near you for assistance with your exchange or return.
I have an item that’s about to be, or already is, too late to exchange or return. What do I do?
Any purchases made between February 8 -15 will be accepted for an exchange or return in store for an additional 7 days after the regular 30-day window.
I have mailed in a return. How will I know if it is being processed?
We apologize for the delay you may be experiencing with your return. We are working hard to process all returns as quickly as possible, but there may be a short delay. You will receive an email confirmation once your refund is processed. For any questions, please contact customer service. Visit help.indigo.ca for options to reach us.
plum & plum PLUS
Have my plum points been impacted?
Customer plum points remain intact and unaffected by the cybersecurity incident.
Will I still get plum points with my purchases?
In Store
All points for in store purchases have been reconciled and updated in My Account. If you have not seen points adjusted in My Account for an in store purchase made between February 8 – 15, 2023, please bring your receipt into a store by April 15, 2023 and we’ll adjust your points balance for you. If you are unable to make it to a store, you can email a copy of your receipt to plumpoints@indigo.ca by April 15, 2023 and we’ll adjust your points balance.
Online
We are currently reconciling points for purchases made online between February 21 – March 7, 2023, and these will be updated in My Account by the end of March. No further action is required if your purchase was made during that time.
Will I receive my plum PLUS discount?
Yes. You will receive your plum PLUS discount when shopping in store and online Please log in to your plum PLUS account online using the email address you registered with.
Will the plum & plum PLUS birthday discount be honoured?
We want to celebrate you! Members celebrating a birthday in February or March will be provided a new birthday coupon via email by March 31, 2023, which can be used in store or online by the end of April 2023.
Can I join the plum PLUS program now?
Yes! We are happy to process new memberships; however, we are currently unable to extend the plum PLUS bonus offer. If you join the plum PLUS bonus program now, we will email you the plum PLUS bonus offer by the end of April to the email address we have on file.
Can I renew my plum PLUS membership?
Yes! As a valued plum PLUS member, you are now eligible to renew your membership. All plum PLUS memberships have been extended by one month from the current expiry date. We will send the current plum PLUS renewal offer to your email by the end of April.
Do my plum points expire?
plum points do expire if you don’t make a qualifying purchase within 12 months. If your points are set to expire in February 2023, we will extend the expiration of any points to March 31, 2023.
For Employees – Current & Former
Will you pay the ransom?
No. The privacy commissioners do not believe that paying a ransom protects those whose data has been stolen, as there is no way to guarantee the deletion/protection of the data once the ransom is paid. Both US and Canadian law enforcement discourage organizations from paying a ransom as it rewards criminal activity and encourages others to engage in this activity.
Additionally, we cannot be assured that any ransom payment would not end up in the hands of terrorists or others on sanctions lists.
What information was affected?
Some employee information including: name, email address, phone number, birth date, home address, postal code, social insurance number as well as employee direct deposit information including name of financial institution, bank account number, and branch number may have been impacted. Please review the communication you have received or will receive from TransUnion for additional detail regarding your personal situation.
A small number of current and former employees may also receive a supplementary communication from Indigo notifying them that additional information was affected. This includes documentation related to immigration applications and status or information related to certain internal HR processes, such as workplace investigations or medical leaves. All those affected have been contacted directly via email or physical mail and advised of the specific information affected. If you have received notice and have follow up questions about the information, please reach out to support-hr@indigo.ca. For any employee who may have had their information affected, we strongly encourage the use of myTrueIdentity services and to activate the Dark Web monitoring service.
Has my information been posted to the dark web?
We have been informed that the criminals responsible for this attack intended to make some, or all of, the data they stole available on the dark web as early as Thursday, March 2, 2023. We are continuing to work closely with the Canadian police services and the FBI in the United States in response to the attack.
How and when will I be receiving information from TransUnion regarding the cybersecurity incident?
TransUnion has started contacting current and former employees directly as of 5 p.m. ET on Feb. 23, 2023 via email using the last personal email address on file with Indigo. For current employees, this email address is reflected in their UKG profile. Please note that the sender of the email is Cyberscout (a TransUnion company) and the subject line is Cybersecurity Incident Notification. For those who do not have a personal email address on file, they will receive the letter via regular mail to their address on file with Indigo, which for current employees is reflected in their UKG profile.
Who will be sending the email, and how do I know it’s safe?
The email sender appears as “Indigo” and the sender email address is Cyberscout. Cyberscout is a TransUnion company assisting with the delivery of your personal TransUnion code.
I am a former employee. Was I affected?
If you were a former employee who ceased to work for Indigo prior to 2015, you were not affected by this incident. Your personal information was not part of the data that was affected. Since you were not affected, you will not be receiving a letter or email with an offer of credit monitoring. Some former employees who were employed at Indigo on or after January 1, 2015 may have been affected by this incident. If you were employed at Indigo on or after January 1, 2015 and you were affected, you will receive an email or letter with an offer of credit monitoring. If you have not received your email or letter by March 6, 2023, you may contact us at support-hr@indigo.ca to verify whether you were affected.
How will you be contacting former employees whose data was impacted?
Former employees will be reached out to via email or postal address depending on what we have on file.