Tens of thousands of pages of documents with information on court dockets, traffic tickets, officer interactions and bail hearings dating back to 1998 were accessed in a cybersecurity attack on police in Kingston, Ont., last year.
Ontario Provincial Police launched an investigation in January 2025 into a “cyber incident” targeting Kingston Police (KP) on Jan. 1, 2025. Police said the incident affected some IT systems, particularly non-emergency functions.
On Friday, Kingston police announced they are “now closing off the cybersecurity incident” and the internal investigation is complete.
Police say the analysis shows a “threat actor used compromised account credentials” to access police systems through the Kingston Police VPN application on Jan. 1, 2025.
“KP’s investigations were not able to determine how the credential compromise occurred. The intrusion was identified by our Acting Director of IT on January 3, 2025,” police said in a media release.
“All systems were shut down within a brief time. By this time, the threat actor had successfully encrypted and extracted 160 GB of data from KP servers.”
- Sign up for daily newsletters of top local stories
- Subscribe to breaking news alerts from CTV News Ottawa
Data accessed
According to police, the 160 GB of data was composed of 345,000 documents, and after analysts culled the documents for duplication and junk, there were 100,000 documents to be analyzed to determine what personal information could be contained.
In a media release, police outlined the categories of personal information affected:
- Criminal court information: Information contained in court dockets dating between 2009 and 2024. Police estimate about 51,000 individuals were impacted, with personal information including name, date of birth, offence details, plea, findings and sentences or other dispositions.
- Provincial offence ticketing information: Police estimate between 50,000 and 100,000 people were affected by this data, which was collected between 2012 and 2024. The data included name, date of birth, offence details, plea, findings and sentence or other disposition.
- Bail hearing lists: Police say the information was about 68,000 adults and young offenders between 2009 and 2022, with the name, date of birth and remand details appearing in the information.
- Excel reports: About 22,000 people were affected with the data obtained between 2000 and 2023. “These reports contained information about individuals interacting with police including adult and young offenders, victims, witnesses, complainants, missing persons, and KP employees and police officers. This information included names, dates of birth, and offence details for those charged, convicted, arrested or ticketed,” police said.
- Remaining data: Police say the information was dated from 1998 to 2020 and affected 80,000 persons, representing a “wide cross-section of persons interacting with police. Police say the information includes 2,000 driver’s license numbers, fewer than 1,000 social insurance numbers (likely of employees) and fewer than 250 persons’ credit card, health card or passport numbers.
Police say people may have been affected by the cybersecurity incident if you:
- Appeared in criminal court between 2009 and 2024
- Received a provincial offence notice between 2012 and 2024
- Appeared on a bail hearing list
- Interacted with KP as a victim, witness, complainant, missing person, arrested person, charged person, convicted person, or recipient of a ticket
- Were a current, former, retired, civilian or sworn employee of KP
- Otherwise provided personal information to KP within the date ranges described above.
Police say experts engaged with the “threat actor,” adding they agreed to delete the data in their possession and to share proof of deletion with Kingston Police.
“Since that time, the OPP, and partners from police agencies around the world, have continued to monitor the dark web, and there has been no evidence of disclosure of any of the data extracted in the nine months that have followed the incident,” police said.
Police said while officers have assessed the likelihood of misuse of the affected information “to be low,” they recommend monitoring financial accounts and credit card statements for unusual activity, contacting financial institutions if you have concerns about your financial information or contacting a government agency if you believe your government-issued identification may have been compromised.
The Kingston Police Services Board has announced plans to invest $3.9 million over the next three years into cybersecurity and improvements to IT infrastructure.
Anyone with a question for the Kingston Police can email cyberinfo@kpf.ca.
