Toronto Public Library cyberattack takes down digital services at 100 branches

The Toronto Public Library, the largest public library system in Canada, said it was responding to a cybersecurity incident that came to its attention on Saturday, October 28, 2023. The system serves roughly 1.2 million members through about 100 branches across the city.

Branches stayed open on their normal schedules and continued to lend and accept returns, and branch telephone lines and Wi-Fi remained in service. The outage hit the technology layer instead: the tpl.ca website, patron account logins, digital collections, the TPL Map Pass program, and the public computers and printing stations inside branches.

In statements issued over the following days, the library said it had activated mitigation measures prepared in advance and engaged third-party cybersecurity experts to investigate and restore systems. It said at the time that there was no evidence the personal information of staff or customers had been compromised, and it initially estimated that full restoration might take several days.

The library did not say whether ransomware was involved or whether a ransom had been demanded, and did not name the attackers. BleepingComputer reported on November 1, 2023 that a ransom note it obtained tied the intrusion to the Black Basta ransomware operation, an attribution the library did not confirm at the time. Recovery ran far longer than first projected, with online services returning only gradually through the following winter. In late November 2023 the library disclosed that data belonging to current and former employees, including home addresses and social insurance numbers, had likely been taken.