Toronto Zoo says patrons' transaction data leaked on dark web in 2024 cyberattack

The Toronto Zoo says a copy of transaction data from its guests and members — including names, addresses and credit card information — was taken and "leaked on the dark web" in a cybersecurity attack on its computer systems more than a year ago.

In an update posted on its website Friday, the zoo said the data taken and leaked due the ransomware attack that happened in January 2024 included information about all guests and members who paid general admission and made membership purchases between 2000 and April 2023. 

The zoo said the compromised data includes first and last names, and in some cases, street address information, phone numbers and email addresses. And for guests and members who made credit card transactions between January 2000 and April 2023, the data includes the last four digits of credit card numbers and associated expiration dates.

"The way the data was leaked has made it difficult to download. It is currently not published, though this could change," the zoo said in the update. 

"We encourage those affected and all our guests and members to be vigilant, and to carefully examine uninvited and suspicious communications and to regularly check financial account statements."

According to the zoo, the privacy breach was reported on Jan. 17, 2024 after the personal data was stolen from a compromised file server. At the time, the zoo believed that current and former staff employed by the zoo from 1989 and a small number of volunteers were affected.

The zoo said the cyberattack did not directly affect its customer information system at the time of the attack, but there was some guest and member data on one of the affected servers.

The zoo began data recovery and analysis immediately following the cyber incident, which was "a very time-consuming process," the update says. Based on this work, the zoo said its providing an update to people whose data was affected.

"This cyber incident has been extremely challenging for us, particularly our current and past employees who had personal information compromised but also due to the loss of decades of wildlife conservation research that was lost as well," the zoo said. 

Since this incident, the zoo said it has taken "significant steps" to ensure its information technology is more secure and it's working with the city's chief information security office to better protect its information and security problems.

The cyberattack was reported to Ontario's Office of the Information and Privacy Commissioner and is being investigated. Individuals affected by the cyberattack do not need to open separate complaints, the zoo said.