Toronto’s public library system has acknowledged that the ransomware gang that hit it last month stole personally identifiable data of employees.
“At this point in our investigation we believe current and former staff employed by Toronto Public Library (TPL) and the Toronto Public Library Foundation (TPLF) from 1998 are impacted,” the library said Tuesday. “Information related to these individuals was likely taken, including their name, social insurance number, date of birth and home address.
“Copies of government-issued identification documents provided to TPL by staff were also likely taken.
“We did not pay a ransom.
“Our cardholder and donor databases are not affected. However, some customer, volunteer and donor data that resided on the compromised file server may have been exposed. It will take us time to analyze data to determine who is affected and how. We will continue to be transparent and notify those affected as appropriate and in light of our findings.”
The municipally-run library is offering two years of complimentary credit monitoring to current and past employees.
The library said last week the Oct. 28 attack was ransomware. Initially it said there was no immediate evidence that data of staff had been stolen.
Municipalities and their library systems are part of what Ontario calls the broader public sector, which also includes hospitals.
Last year, the provincial government received a report from an expert panel on cybersecurity in the provincial broader public sector, which concluded there has been a “systemic underinvestment in both legacy technology replacement and cybersecurity” in the broader public service (BPS).
A key recommendation was that the province create a single body to oversee cybersecurity across the entire broader public service, dispensing advice and demanding accountability. It would augment current governance structures responsible for sector-specific cyber security risks
In response to that report, the government said it “accepted recommendations outlined in the final report.” However, no timeline for implementing the recommendations was given.