Toronto Zoo, the largest zoological park in Canada, said the data security incident it suffered last year compromised the sensitive personal information of every individual who visited the zoo in the last 23 years.
In January 2024, Toronto Zoo said it identified suspicious activities in its internal network which later turned out to be a ransomware attack. Authorities at the 287 hectare zoological park said the incident did not impact animal wellbeing, care and support systems and that it continued to receive visitors.
The organisation said in a press release in early March that an investigation into the cyber security incident revealed that a “copy of transaction data was taken and was leaked on the dark web.”
“The way the data was leaked has made it difficult to download. It is currently not published, though this could change. The data includes information about all guests and members who engaged in the following types of transactions between 2000 to April 2023: general admission and membership purchases,” it said.
The compromised data included names, addresses, phone numbers and e-mail addresses. While Toronto Zoo initially said it doesn’t store any credit card information, the recent update states that guests and members who made credit card transactions between January 2022 and April 2023 had the last four digits of credit card numbers and associated expiration dates compromised during the incident.
“Phishing and online fraud is ever present today. We encourage those affected and all our guests and members to be vigilant, and to carefully examine uninvited and suspicious communications and to regularly check financial account statements,” zoo authorities added.
Toronto Zoo says the ransomware incident not only impacted visitors, but also compromised the personal information of current and past employees as well as decades of wildlife conservation research.
“Since this incident, we have taken significant steps to ensure our information technology is more secure and have been working closely with the City of Toronto’s Chief Information Security Office and we are grateful for their expertise and ongoing support. Our enhancements will give us significantly better network defenses and better ability to detect security problems,” it added.
On January 25,2024, the Akira ransomware group claimed responsibility for the cyber attack on Toronto Zoo and listed it as a victim on its data leak site. The group claimed to be in possession of around 133 GB of data, including NDAs, confidential agreements, and personal files.
