Cybersecurity policies are only as good as the systems in place
to make sure they're followed. The recent investigation by the
Information and Privacy Commissioner of Ontario
("IPC") into the effectiveness of the
Toronto Transit Commission's ("TTC")
cybersecurity measures to prevent a cyber attack underscores this
point.1
This bulletin will review the IPC's key findings and
recommendations relating to the TTC's cybersecurity and
incident response practices.
Background: The Ransomware Attack and the TTC's
Response
In late 2021, the TTC experienced a ransomware attack on its IT
systems. A threat actor sent an email to a TTC employee from the
email address of a trusted third party, whose systems the threat
actor had compromised. The employee clicked a malicious link in the
email, allowing the threat actor to infiltrate the TTC's
systems. The threat actor then exploited a security vulnerability
and used malware to encrypt and transfer data, including
