Black Basta ransomware group claims cyber attack on Toronto Public Library

The notorious Black Basta ransomware group has claimed responsibility for a major cyber attack on the Toronto Public Library that temporarily took down the library’s web domain and certain online services.

Last week, Toronto Public Library (TPL) said it experienced “technical difficulties with some online services” that impacted the tpl.ca domain and customers’ online accounts. The technical outage also affected the library’s in-branch WiFi and printing services.

 

Authorities at Toronto Public Library later said that they were dealing with a cyber security incident which was discovered on October 28.

“As a result of the incident, the following services are unavailable: tpl.ca, “your account”, tpl:map passes and digital collections. Public computers and printing services at our branches are also unavailable,” they said.

TPL added that its branches are open as scheduled, Wi-Fi is available in library branches, and branch telephone lines are now working. Materials can be borrowed and returned in branches until further notice.

TPL authorities said they notified relevant law enforcement authorities about the security incident and are working with cyber security experts to resolve the issue and understand the nature and scope of the incident.

“As of now, there is no evidence that the personal information of our staff or customers has been compromised. TPL has proactively prepared for cybersecurity issues and promptly initiated measures to mitigate potential impacts,” the library said.

 

The library said on Monday that it expects the disrupted online services to be restored in a week or more. “Based on our progress to date, we anticipate that it will take a week or more before all systems are fully restored to normal operations. However, we expect that some services will be brought back online before then,” it said. 

“We have engaged with third-party cybersecurity experts to help us in resolving this situation. We do anticipate though that it may take several days before all systems are fully restored to normal operations,” it added.

According to BleepingComputer, the infamous Black Basta ransomware group has claimed responsibility for the cyber attack on TPL and shared a copy of the ransom note with the publication as proof of the hack. It’s not clear so far whether the ransomware group only encrypted the data, as per the ransom note, or exfiltrated information before encrypting.

However, according to Bleeping Computer, the security incident did not impact phones and had limited impact on email services. While several systems were taken offline to contain the spread of the malware, the main servers containing sensitive data were not encrypted.

In May, the Black Basta ransomware gang also claimed responsibility for a cyber attack on Swiss multinational technology giant ABB that affected the company’s daily operations and forced it to take its VPN connection offline.