The Toronto Zoo fell victim to a major cyberattack that exposed the personal and financial data of visitors, members, employees, volunteers, and donors. The breach, claimed by the Akira ransomware group, compromised records dating as far back as 2000, making it one of the most significant security incidents in the zoo’s history.

As soon as the attack was discovered, the zoo launched an investigation, working with cybersecurity experts and authorities to understand the full extent of the damage. Despite these efforts, hackers managed to leak stolen data on the dark web and wipe out decades of valuable wildlife conservation research.

The breach disrupted operations and serves as a stark reminder of the growing threat cybercriminals pose to public institutions.

Why It Matters: Visitors, employees, and donors now have their personal details floating around on the dark web, creating risks of identity theft, phishing scams, and financial fraud. This attack serves as a wake-up call: even beloved public institutions aren’t safe from cybercriminals, and stronger protections are needed to keep both people and critical research secure.

• Scope of the Breach: The cyberattack compromised transaction data of all guests and members who purchased general admission tickets or memberships between 2000 and April 2023. Exposed information includes names, addresses, phone numbers, and email addresses. For transactions made with credit cards between January 2022 and April 2023, the last four digits of card numbers and expiration dates were also accessed.

• Attack Attribution: The Akira ransomware group claimed responsibility for the breach, asserting they had stolen 133 gigabytes of data, including confidential agreements and personal files. Akira, active since March 2023, has targeted over 250 organizations globally, amassing approximately $42 million in ransom payments.

• Data Exposure and Risks: The stolen data was leaked on the dark web, though its accessibility remains limited. The zoo has advised affected individuals to remain vigilant against phishing and online fraud attempts and to monitor financial statements for suspicious activity.

• Impact on Operations and Research: While the attack caused operational challenges, it notably resulted in the loss of decades’ worth of wildlife conservation research, a significant setback for the zoo’s conservation initiatives.

• Response and Mitigation Efforts: Following the breach, the Toronto Zoo notified affected parties, including employees dating back to 1989, offering credit monitoring services. The incident was reported to the Office of the Information and Privacy Commissioner of Ontario, which initiated an investigation. The zoo has since enhanced its cybersecurity measures in collaboration with the City of Toronto’s Chief Information Security Office to prevent future incidents.

Go Deeper -> Two decades of visitor data at the Toronto Zoo stolen in cyberattack – The Record

Toronto Zoo shares update on last year’s ransomware attack – BleepingComputer

Toronto Zoo Cybersecurity Incident Final notification – Toronto Zoo