Toronto Public Library Cyberattack Takes Down Digital Services at 100 Branches

The Toronto Public Library, the largest public library system in Canada, said it was responding to a cybersecurity incident that came to its attention on Saturday, October 28, 2023. The system serves roughly 1.2 million members through about 100 branches across the city.

Branches stayed open on their normal schedules and continued to lend and accept returns, and branch telephone lines and Wi-Fi remained in service. The outage hit the technology layer instead: the tpl.ca website, patron account logins, digital collections, the TPL Map Pass program, and the public computers and printing stations inside branches.

In statements issued over the following days, the library said it had activated mitigation measures prepared in advance and engaged third-party cybersecurity experts to investigate and restore systems. It said at the time that there was no evidence the personal information of staff or customers had been compromised, and it initially estimated that full restoration might take several days.

The library did not say whether ransomware was involved or whether a ransom had been demanded, and did not name the attackers. BleepingComputer reported on November 1, 2023 that a ransom note it obtained tied the intrusion to the Black Basta ransomware operation, an attribution the library did not confirm at the time. Recovery ran far longer than first projected, with online services returning only gradually through the following winter. In late November 2023 the library disclosed that data belonging to current and former employees, including home addresses and social insurance numbers, had likely been taken.

Updates

• November 15, 2023

  Toronto Public Library confirmed in November 2023 that the attack was ransomware and that files taken from a compromised server held employee records going back to 1998, including social insurance numbers, dates of birth, home addresses and copies of government identification. In December 2024 the library put the number of affected cardholders, donors and unsuccessful job applicants at about 4,100.

Sources

• Toronto Public Library facing disruptions due to cyberattackThe Record
• Cybersecurity incident takes down Toronto Public Library website, public computersCP24
• Toronto Public Library hit with cyberattack and here's what you need to knowblogTO
• Toronto Public Library cyberattack updateGlobal News
• Toronto Public Library outages caused by Black Basta ransomware attackBleepingComputer