Toronto Zoo says credit card info ‘leaked on the dark web’ in cyber attack
Posted Mar 2, 2025 06:28:15 PM.
Last Updated Mar 3, 2025 03:44:43 AM.
The Toronto Zoo says transaction data, including credit card information, was “leaked on the dark web” following a cyber attack more than a year ago.
The zoo published a final update this weekend on the January 2024 incident, saying information about all guests and members who paid general admission and made membership purchases between 2000 and April 2023 was obtained in the ransomware attack.
The data that was compromised includes first and last names and, in some records, street addresses, phone numbers and email addresses. For guests and members who made credit card transactions between January 2022 and April 2023, the last four digits of their credit card and expiration dates were taken.
“A copy of transaction data was taken and was leaked on the dark web last year,” the zoo said in its statement issued on Friday. “The way the data was leaked has made it difficult to download. It is currently not published, though this could change.”
The zoo adds that with the increasing presence of phishing and online fraud, they are encouraging those affected to be vigilant and regularly check their financial account statements.
Zoo officials first reported the privacy breach on January 17, 2024, when it said personal data from a compromised file server had been stolen. At that time it was believed that the data involved only current and former employees dating back to 1989.
“This cyber incident has been extremely challenging for us, particularly our current and past employees who had personal information compromised but also due to the loss of decades of wildlife conservation research that was lost as well,” the zoo said in its update.
The zoo says the matter has been reported to the Office of the Information and Privacy Commissioner of Ontario (the IPC), and an investigation file has been opened. Officials say they have taken significant steps to ensure their information technology is more secure and they are better able to detect security problems.
