Toronto Zoo discloses new findings on 2024 ransomware incident

One of the largest Canadian zoos, Toronto Zoo, has disclosed new information about the stolen data during last year’s January ransomware attack.

The zoo explained in a new statement that the resulting data breach impacts the personal and financial information of its employees, former employees, volunteers, and donors.

Moreover, the malicious activity has also affected the transaction data, such as impacted persons’ names, street addresses, phone numbers, and e-mail addresses. It also includes the last four digits of credit card numbers and their expiration dates for guests and members who used credit cards between January 2022 and April 2023.

The statement also noted that the compromised data includes information about all guests and members who purchased general admission or memberships between 2000 and April 2023.

The zoo disclosed the incident in January last year, stating that the attack did not influence the animals’ well-being or day-to-day operations. However, it reported the data breach to IPC, and anyone affected should monitor their financial accounts for suspicious behaviour.

 

The Akira ransomware group claims credit for last year’s cybercriminal activity against Toronto Zoo.

 

Toronto Zoo did not attribute the ransomware incident to a specific threat actor or hacking organisation. However, the Akira ransomware gang claimed responsibility for the attack in the same month last year.

The group also posted the alleged stolen data on its dark web leak site as proof of the legitimacy of its attack. The group stated that it had stolen at least 133 GB of files from the zoo’s compromised file server, which contained database backups, ticket information, and other user information.

In early February, the cybercrime group started circulating a torrent file with numerous archives holding more than 35GB of this material.

The data includes numerous NDAs and confidentiality agreements. It also contains specific personal files, such as driver’s licenses. The ransomware gang also claims on its leaked site that there is much intriguing information regarding animals.

Akira first appeared in March 2023 and immediately gained notoriety after claiming a long list of victims from various industries globally. Lastly, this group commonly seeks ransoms ranging from $200,000 to millions of dollars relative to the size of the affected firm.