Up to 25,000 TTC employees' personal information may have been stolen in cyber attack, agency says

The TTC said further investigation into an online ransomware attack that hit some of the agency's systems a few weeks ago, appears to may have stolen personal information of its current and previous employees.

Transit agency to provide credit monitoring, identify theft protection to those affected

The TTC said it appears that personal information including the names, addresses and Social Insurance Numbers of up to 25,000 employees, may have been stolen in an online ransomware attack in October. (Evan Mitsui/CBC)

Personal information of tens of thousands current and former employees of the Toronto Transit Commission may have been stolen, the transit agency says based on further investigation into an online ransomware attack that hit some of its systems a few weeks ago. 

In a news release Monday, the TTC said the compromised information may include the names, addresses and Social Insurance Numbers of up to 25,000 employees. 

The agency said it continues to investigate whether a small number of customers and vendors may also be affected.

"It is very important to note that, at this time, there is no evidence that any of the personal information that was accessed has been misused," the release noted.

The cyber security attack, which the TTC said they became aware of on Oct. 29, resulted in problems with vehicle tracking systems, the loss of the online Wheel-Trans booking system, issues with the "next bus" system, as well as problems with internal emails, the CEO of the TTC Rick Leary said.

"Over the past week, we have been working day and night to resolve this situation – to get our lost services back online and to gain a clearer understanding as to the breadth of the incident," Leary said in a statement Monday.

Over the coming weeks, the TTC will continue to work on re-building the remaining impacted servers and internal service, which he added could take "some time."

The TTC said it is notifying individuals who may have been affected and will be providing credit monitoring and identity theft protection to them "as appropriate."

"Again, while we do not have evidence that any of this information has been misused, we are taking steps to ensure those who may be impacted are protected from things like identity theft."


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Member

Join the conversation  Create account

Already have an account?