National Gallery of Canada recovers from ransomware attack

The National Gallery of Canada discovered a ransomware attack on April 23, 2023 and shut down its IT systems in response. The Ottawa institution spent the following weeks rebuilding servers and restoring access, and was still working through the recovery when the incident was reported in mid-May.

Interim director Angela Cassie said no client data was stolen, though some operational data was lost. The gallery told members that its payment systems were not affected and that it does not store full credit or debit card numbers.

The gallery isolated the affected networks, commissioned a forensic investigation from an outside cybersecurity firm and worked with the Canadian Centre for Cyber Security on the response. No ransomware group claimed responsibility for the attack.

The museum stayed open to visitors throughout. Many staff worked remotely while servers were rebuilt, and a gradual return to the office began about three weeks in, by which point online ticketing, membership and boutique systems were operating again. Memberships that expired during the outage were honoured and promotions were extended.