Hundreds of thousands of documents extracted from Kingston Police during 2025 ...

Kingston Police Force has closed the case on a cybersecurity incident suffered by the service in January of last year.

According to a news release, the force explained how the incident happened and what steps it has taken to move forward.

Officials explained that a threat actor used compromised account credentials to access the force’s systems through its VPN application on Jan. 1, 2025.

While investigators were not able to determine how the credential compromise occurred, they were able to identify the issue on Jan. 3 when all systems were shut down.

Unfortunately, by that time, police said the threat actor had successfully encrypted and extracted 160 GB of data from the servers. That data included 345,000 documents, a majority being newsletters and bulk e-mails, according to analysts. Officials said 100,000 documents were determined to be personal information and may have included the following information:

Criminal court dockets: between 2009-2024 impacting 51,000 individuals.

Provincial offence tickets: between 2012-2024 estimated to impact between 50,000 and 100,000 individuals.

Bail hearing lists: between 2009-2022 relating to 68,000 people.

Excel reports: between 2000-2023 affecting 22,000 people.

Remaining data: between 1998-2020 affecting approximately 80,000.

Cybersecurity experts from the Ontario Provincial Police were brought in to investigate and restore its systems. They were able to engage with the threat actor, who agreed to delete the data in their possession and proof that it was indeed deleted.

“Since that time, the OPP, and partners from police agencies around the world, have continued to monitor the dark web, and there has been no evidence of disclosure of any of the data extracted in the nine months that have followed the incident,” read a statement from the release.

While the service can’t guarantee that the information extracted has been disclosed, copied, or misused, they believe the assessment of risk remains low.

“KP remains confident that the likelihood of disclosure of this data, particularly given the passage of time, is very low, but our partners remain vigilant in monitoring the dark web for signs of disclosure,” the release read continued.

According to a news release, the service has since upgraded their cybersecurity practices and has created a plan to upgrade and strengthen its IT infrastructure.

As a result, Kingston Police and the Kingston Police Services Board have developed plans, with the help of experts, to invest $3.9 million over the three years into cybersecurity and improvements to IT infrastructure.

In addition, there will also be a 50-per-cent increase of full-time IT staff, which will result in an increase from four to six staff members.

“In today’s digital age, advanced IT and cybersecurity are essential for effective communication, decision-making and uninterrupted service to the residents of Kingston. It is important that we make the necessary investments to ensure optimal service and security,” read the release.

Police noted that while the likelihood the information has been misused is low, they have advised impacted individuals to take precautions to protect themselves.

Depending on the type of information involved, police said people may consider the following:

Monitoring financial accounts and credit card statements for unusual activity.

Obtaining and reviewing their credit report.

Contacting their financial institution if they have concerns regarding financial information that may have been affected.

Contacting the relevant government agency if they believe a government-issued identifier (such as a driver’s licence, health card, passport, or Social Insurance Number) may have been compromised.

Remaining vigilant against suspicious communications, including phishing emails, text messages, or phone calls requesting personal information.

Officials with Kingston Police said should additional information become available, it will be shared with the public. Anyone with questions can [email protected]

Complaints the data breach can be made to the Information and may be made to the Information and Privacy Commissioner of Ontario (IPC) through their website or by regular mail at: 2 Bloor Street E., Suite 1400, Toronto, ON, M4W 1A8.

Kingston Police warn residents of ongoing bank scams

Police warn Kingston residents after elderly victim targeted in jewelry swap scam

Kingston Police for inmate who walked away from Collins Bay Institution