Toronto Public Library says services affected by cyberattack to be restored starting in January

Toronto Public Library (TPL) says services affected by an Oct. 28 cybersecurity attack will not begin to be restored until January.

In a statement on Thursday, the library system said it considers the timeframe for restoration of services to be "aggressive" given the experience of other institutions that have endured such attacks.

"Given the complexity and magnitude of this task involving TPL's data centre and computers across 100 library branches, and the interconnectivity of our systems, we anticipate the restoration of library services will take several more weeks," TPL said in the statement.

"Access to services will be restored gradually beginning in January, with priority given to the reinstatement of tpl.ca and public computing services."

TPL said it realizes the length of time that is needed to bring back services is challenging for users and the delay is frustrating.

"We recognize that this is a long period of time without full library services, but this is considered an aggressive timeframe within the context of such an attack and the experience of other institutions in similar circumstances," it said.

TPL said its staff, along with experts, have been working steadily to restore the systems affected by the attack and to improve network security. That work involves ensuring each system is secure before it is brought back online, TPL said.

Library grateful for support from users

The library system says it is grateful for the support it has received.

"We appreciate your patience and understanding while we do everything we can to restore our services as quickly as possible."

The library first announced it was the victim of a "cybersecurity incident" on Oct. 28, the day it became aware of the attack. It did not pay a ransom to recover the stolen material.

Reports were filed with the Toronto Police Service and the Information and Privacy Commissioner of Ontario.

Police confirmed Friday an investigation is underway. 

TPL has said personal information — including the names, birthdays, social insurance numbers and home addresses — of employees was stolen in the attack.

The large number of stolen digital files include key personal information of current and former employees of TPL and the Toronto Public Library Foundation dating back to 1998. Copies of government-issued identification documents related to those staff members were also likely taken, TPL has said.

The library added that cardholder and donor databases were not impacted by the attack. 

The library says the following is currently not available:

• tpl.ca and online personal accounts.
• Public computers.
• Printing.
• tpl:map passes.
• Some digital collections, including Cantook Station, LinkedIn Learning and O'Reilly Learning.
• Placing, suspending or managing holds.
• Renewing library cards, although library cards won't expire during this time.
• Self-service hours at Swansea and Todmorden Room branches.

The library has a list of frequently asked questions to help users navigate its system while services are unavailable. It also provided an email and phone number for those looking for extra guidance: [email protected] and 416-397-5981.