Calgary Public Library

Summary

A cybersecurity breach at Calgary Public Library compromised systems, prompting immediate closure of all physical locations and deactivation of servers and public computer access to mitigate impacts. The library prioritized investigating the breach's scope while acknowledging potential risks to patron data, including names, addresses, and possible payment details. The incident disrupted scheduled events, forcing a partner organization to relocate a festival presentation as a precaution. An expert highlighted libraries' vulnerability to such attacks due to their extensive repositories of personal information and historically weaker security measures compared to other institutions. Operational disruptions persisted with branches remaining closed indefinitely pending further updates.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 11, 2024, the Calgary Public Library (CPL) experienced a cybersecurity breach that forced the early closure of all physical library locations at 5 p.m. Mountain Time. The library confirmed some systems were compromised and implemented immediate containment measures, including shutting down all servers and disabling public computer access across its network. CPL announced branches would remain closed indefinitely pending further investigation, with updates to be provided as new information emerged. The library emphasized data security as a priority, with its security team actively assessing the scope of the breach. This disruption impacted scheduled public events, including Wordfest's Imaginairium Festival scheduled for October 15-21 at library venues, prompting organizers to relocate at least one event—the October 15 presentation featuring Susanne Craig—to the DJD Dance Centre Theatre as a precautionary measure.

The incident highlighted systemic vulnerabilities in library cybersecurity infrastructure, as noted by University of Calgary professor Tom Keenan, who observed that libraries globally are frequent targets due to their extensive patron databases and historically weaker security protocols. CPL's breach potentially exposed personal information collected during library card registrations, including names, addresses, email contacts, and possible historical payment details for fines. While the library did not disclose specific data categories compromised or the attack vector, its decision to isolate systems reflected standard incident response protocols to prevent further unauthorized access. Public reactions varied, with some patrons like student Justine Agrado expressing resigned acceptance of cybersecurity incidents as inevitable operational risks. The library maintained operational silence beyond initial statements, focusing on forensic analysis without providing restoration timelines or additional breach specifics.

Sources

Sources available to members: 1 source.