The Toronto Public Library (TPL) has released the findings of its investigation into a cyberattack that disrupted its systems for months, revealing that personal data belonging to thousands of individuals may have been exposed. The breach affected 4,100 non-employees, including cardholders, donors, and unsuccessful job applicants, stemming from interactions with the library between 2010 and 2023.
The compromised data includes contact information, physical descriptions, and, in some cases, photo images of affected individuals. Additionally, the personal details of current and former staff dating back to 1998, such as social insurance numbers and copies of government-issued identification, were also accessed by the attackers.
The cyberattack was discovered on October 28, 2023, and caused significant disruptions to TPL’s operations. Online services were offline until March 2024, leaving cardholders unable to use library printers and computers across its 100 branches. Even routine processes, like returning books, were impacted, with returned items stored in tractor trailers during the outage due to the inability to process them digitally.
In its statement, the TPL acknowledged the challenges posed by the incident, emphasizing that it has learned critical lessons to bolster its cybersecurity. “We have learned from this adversity and have taken concrete steps to improve our systems, safeguard our data, and fortify our defenses,” the library said.
The TPL has reported the breach to the Office of the Information and Privacy Commissioner of Ontario, which has initiated an investigation. The library also encouraged individuals who believe their data may have been included in the breach to contact cyberincident.support@tpl.ca for assistance.
