The Toronto Public Library continues to experience technical outages that appear to be due to a ransomware attack by the Black Basta gang .
The Toronto Public Library (TPL) is the largest public library system in Canada, with over 100 branches throughout the city. It has 1.200.000 registered members and provides access to more than 12 million books.
Earlier this week, the library announced that a cyberattack led to the outage of websites and online resources.
The library warned that public computers and printing services are also unavailable.
See also: Over 40 countries to sign to stop paying ransoms to ransomware gangs
The Toronto Public Library has not yet found any evidence that any personal information of staff or patrons has been compromised. The library is working with law enforcement and third-party cybersecurity experts to investigate the incident.
“TPL has prepared for cybersecurity issues and has taken steps to mitigate potential impacts,” a statement on a temporary website.
“We have worked with third-party cybersecurity experts to assist us in resolving this situation. However, we anticipate that it may take several days for all systems to be fully restored.“.
Black Basta ransomware behind the attack on the Toronto Public Library?
According to BleepingComputer, the Black Basta ransomware gang is behind the attack on the Toronto Public Library. BleepingComputer has apparently seen a photo of the note ransom sent to the library.
According to a TPL employee, the attack occurred on the night of October 27, affecting many services.
See also: What we've learned from ransomware attacks on large companies
BleepingComputer was told that the attack did not affect phones and had limited impact on email. However, employees who were not logged into email at the time lost access to the system.
All other internal systems were shut down after attack , as a precautionary measure to prevent the spread of the malware.
According to sources from BleepingComputer, the main servers of the organization that contain sensitive data were not encrypted, therefore the attackers did not have full access to the organization's networks and data.
Although the gang is known for stealing data, with the aim of blackmailing victims, it has not yet been determined whether the same happened with the library attack.
Attack impacts
The potential consequences of the ransomware attack on the Toronto Public Library could be multiple. First, the attack has already led to the disruption of many library services , affecting users' access to books, magazines and other information resources
Additionally, ransomware attacks can cause data loss or corruption, as attackers typically encrypt files and demand a ransom to decrypt them. This can have serious consequences for the library, as it can lose valuable data, such as user information, log files, and other important information.
See also: Chilean Government: Warns of Black Basta ransomware attacks
Finally, a ransomware attack can have a negative impact on the reputation and public trust in the library. Users may be concerned about the security of their personal information and avoid using library services in the future.
Black Basta ransomware
The Black Basta ransomware gang began its activities in April 2022 and quickly began targeting companies in attacks (system encryption and data theft).
Protection measures
· Use of reliable and advanced antivirus software
· Create backups, especially for essential files
· Regularly update systems, applications and antivirus programs
· Training employees to recognize suspicious emails
· Use filters to automatically block suspicious emails
· Use of firewall and VPN
· Network segmentation
Source: www.bleepingcomputer.com
