Notice of Cybersecurity Incident

Revised Notice Posted: August 5, 2026

On April 13, 2025, Royal Drugs Inc. ("Royal") detected suspicious activity within its information systems and immediately engaged independent cybersecurity and forensic experts to investigate. The investigation determined that an unauthorized third-party threat actor gained access to Royal's network between March 17, 2025 and April 13, 2025 and deployed ransomware. As a result of the attack, data stored on Royal's systems, including personal health information in Royal's custody, was encrypted. Royal promptly contained the incident, terminated unauthorized access, and has since restored its systems and operations.

The incident affected systems supporting Royal's operations at the following locations:

The investigation determined that all data stored on Royal's affected systems, including personal health information, was encrypted as a result of the ransomware attack. The personal information and personal health information maintained by Royal may have included names, addresses, telephone numbers, email addresses, product descriptions, product quantities, order dates, and information relating to the provision of pharmacy and home healthcare services.

Royal's investigation also determined that a limited amount of incomplete information was exfiltrated from its network during the incident. The information identified as having been exfiltrated was limited to names, contact information, product descriptions, product quantities, and order dates. Royal has found no evidence that financial account information, payment card information, government-issued identification numbers, or detailed clinical records were exfiltrated. At this time, Royal is not aware of any misuse of the information involved in this incident.

In response to this incident, Royal has:

  • Retained independent cybersecurity experts to investigate the incident and assist with remediation;
  • Contained the incident and restored affected systems and data;
  • Implemented additional security measures to further protect its systems and information;
  • Notified the Information and Privacy Commissioner of Ontario ("IPC"); and
  • Reported the incident to law enforcement, including the Canadian Centre for Cyber Security.

Although Royal is not aware of any misuse of information associated with this incident, individuals are encouraged to remain vigilant for suspicious communications, including unsolicited emails, telephone calls, or text messages requesting personal information. Individuals should exercise caution before responding to unexpected requests for information and independently verify the legitimacy of any communication that appears to originate from Royal or another trusted organization.

If you would like confirmation as to whether your information was affected by this incident, please complete the form below and Royal will contact you. If your personal health information was impacted by this incident, you are entitled to make a complaint to the Information and Privacy Commissioner of Ontario under Part VI of the Personal Health Information Protection Act, 2004. However, the IPC has advised that filing a complaint is not required as it is already investigating this matter.

For additional information regarding this incident, please contact: 

Royal Drugs Inc.
Cyber Inquiries
Email: cyberinquiry@oms.ca

Royal regrets any concern this incident may cause. Protecting the privacy and security of the information entrusted to Royal remains a top priority, and Royal continues to take steps to strengthen its security safeguards.

Safeguarding the personal health information entrusted to us is our top priority, and we are committed to supporting any customers who have concerns or may have been affected by this incident.

This field is for validation purposes and should be left unchanged.
Name(Required)
Home or Delivery Address(Required)