Indigo Books & Music is now warning that the stolen information could be leaked to the underground web – also known as the “dark web” – as early as Thursday.

The company clarifies that it decided not to pay the ransom because “there can be no assurance that ransom payments will not fall into the hands of terrorists or others on sanctions lists.”

“Although we do not know the identity of the criminals, some criminal groups using LockBit are linked to Russian organized crime,” the company says.

Paying the ransom cannot protect even those whose data has been stolen, as there is no way to guarantee that the data will be deleted once the ransom is paid, she adds.

Although the company’s investigation found no evidence that customer information, such as credit card numbers or passwords, was accessed, Indigo says data on some current and former employees was compromised during the attack.

The Toronto-based retailer is offering two years of identity theft surveillance to current and former employees affected by the security breach.

Cyberscout, a TransUnion company, will be reaching out to employees directly to notify them of the cybersecurity incident.

Indigo’s new website is now live, although customers are still unable to make any purchases, except for “specific books”.

Harley Finkelstein, president of tech giant Shopify, says Indigo has reached out to his company to bring the bookstore back online.

“They came to us and in three days we were able to build them a new website, bring it back online and sell it,” he wrote on Twitter.

Indigo stores – which were restricted to cash payments for several days – have fully reopened and can once again accept credit and debit card payments.