The IT forensic investigation, conducted in collaboration with external cybersecurity experts, is still ongoing. The investigation indicates that internal support and administration systems have been compromised. Currently, there is no evidence that customer data has been compromised.
In an email to its customers, the company states that it will inform affected parties as soon as the investigation shows that data related to their organization has been impacted. The company also adds in the customer email:
We sincerely apologize for the concerns and problems this situation causes you.
The company has also established a specific email address for questions regarding the incident. The incident has been reported to the Police and the Swedish Data Protection Authority, IMY.
The data breach was discovered and originally communicated on Thursday, September 3rd. To limit the effects of the attack, Dustin chose to proactively shut down parts of its IT environment, which resulted in both e-commerce and logistics flows being stopped. The company then activated its crisis management group to ensure rapid decision-making and coordinated communication. All systems now being brought back online undergo security checks and validation before being used in production again.