Nordik Spa alerts clients of data breach 

Djeneba Dosso

The spa communicated the breach to clients through an email sent on April 5.

Nordik Spa advised clients that personal information including names, addresses, contact information and gift card details had been stolen and shared in an email sent out in the early afternoon of April 5. 

The unauthorized third-party had access to the spa’s system from November 4, 2022, to February 27, 2023. Gift card purchases were the bulk of the targeted transactions explained Nordik Group’s Chief Operations Officer, Alexandre Cantin in the notice. 

The Nordik Group noticed a pattern of suspicious activity linked to their gift certificate system in late February 2023, at which point they shut down their system to further investigate. Ultimately, taking a closer look revealed a breach of confidentiality.

“We take our role in safeguarding your personal information very seriously,” COO Alexandre Cantin wrote in the email statement, adding that victims were alerted as soon as they learned of the problem.

After reporting the incident to authorities and affected corporations, the Nordik Group vouches to ensure this will be a single incident. 

“We will work with third-party experts to continuously strengthen security measures and maximize the protection of our client’s data,” Cantin assured. 

The Nordik Group closed off their notice by advising their clients to “stay vigilant and report any suspicious activity, emails or text messages to local authorities.” However, any gift card that has yet to be redeemed is still valid. Clients were encouraged to reach out to questions@groupenordik.com in the event they have any questions or concerns or to contact the Canadian anti-fraud centre on their toll free line 1-888-495-8501. 

“Your personal information and business are important to us,” Cantin concluded. “Please rest assured that we have done and are doing everything we can to rectify the situation.”

No information regarding the refunds or compensation of affected gift cards balances have been released yet. 

Photo caption: As pictured, the Nordik Spa located in the municipality of Chelsea in Quebec was victim of a data breach from November 2022 to February 2023.

Photo Credit: Courtesy of Nordik Spa-Nature.