Risk of info leaked ‘low’ after cyberattack against force: Kingston police

Kingston police say the likelihood of the leaking of personal information following a data breach that targeted the force at the beginning of last year is low.

The force released a public notice Friday saying an internal investigation of the cybersecurity incident is now complete and officials remain “confident” that disclosure is unlikely.

The breach, which happened when a hacker used “compromised account credentials” to access internal systems, led to the extraction of approximately 160 GB of data, police said.

Security personnel identified the incident on Jan. 3, 2025, and shut down all systems, engaging Ontario Provincial Police (OPP) in the investigation.

Police said the data included 345,000 documents, 100,000 of which were slated for analysis to identify what personal information may have been obtained.

Criminal court information, provincial offence ticketing information, bail hearing lists and Excel reports from 2000 to 2024 were compromised — all of which contained personal information, including names, dates of birth, offence details, pleas, findings and sentences.

Story continues below advertisement

Police said a wide range of information dated from 1998 to 2020 was also compromised, affecting approximately 80,000 people who interacted with police in a variety of capacities. Officers said 2,000 driver’s licence numbers, 250 credit card, health card or passport numbers, and fewer than 1,000 social insurance numbers were contained in this information.

Get breaking National news

Get breaking Canada news delivered to your inbox as it happens so you won't miss a trending story.

Investigators engaged with the hacker, who agreed to delete the data and show proof of its deletion, police said. A spokesperson for Kingston police would not share what this proof of deletion entailed.

“We understand that people may be concerned, and we take that seriously. We recognize the trust our community places in us, and we remain committed to transparency and to strengthening the systems that protect the information collected by and entrusted to Kingston Police,” Kingston Police Chief Adam MacIntosh told Global News in an email statement.

According to police, OPP and other partners have continued to monitor the dark web, and there has been no evidence of any kind of leak of the compromised data.

“[Kingston Police] remains confident that the likelihood of disclosure of this data, particularly given the passage of time, is very low,” the notice says.

Story continues below advertisement

At the end of the 2025 fiscal year, police said the cyberattack cost the force approximately $1 million.

The Kingston Police Services Board said it plans to invest $3.9 million over the next three years to improve cybersecurity and IT infrastructure.

According to the release, Kingston Police will also have 50 per cent more full-time IT staff to support the improved infrastructure.

Police said that anyone who interacted with police or appeared in court during the timeframe identified as part of the breach, can take precautions by monitoring credit card statements and contacting the relevant government agency if they believe their ID may have been compromised.