Toronto Public Library says more than 4,000 non-employees affected by cyberattack

A year after a cyberattack brought down systems at the Toronto Public Library (TPL) for months, the results of an investigation into the breach show that thousands of cardholders, donors, and unsuccessful job candidates may have also been affected.

In a news release issued Monday, the TPL released the results of its investigation into the hack, noting that the potentially compromised data of those 4,100 non-employees stemmed from their “dealings” with the library between 2010 and 2023.

Some of the personal data caught up in the breach include the contact information, physical descriptions, and even photo images of some of those individuals.

Library staff first discovered their network had been hacked on Oct. 28, 2023, which brought online services to a halt until March 2024 and left cardholders without the use of printers and computers at the institution’s 100 branches.

The personal information of current and former staff members dating back to 1998, including social insurance numbers and copies of government-issued identification, was also caught up in the cyberattack, forensic investigators found. The library couldn’t process returned books digitally during the outage and were forced to store them in tractor trailers.

“While navigating this cyber incident has undoubtedly been a challenging experience, it has provided TPL with invaluable lessons that will strengthen us for the future,” the TPL said in a statement, adding that Monday’s news release serves as a “final notification” to those who may have had their data exposed.

“We have learned from this adversity and have taken concrete steps to improve our systems, safeguard our data and fortify our defences.”

The library said it has reported the hack to the Office of the Information and Privacy Commissioner of Ontario and that an investigation has opened.

If you believe your data was included in the breach, the TPL advises emailing [e-mail].