A cyberattack that struck the Toledo Lucas County Public Library's computer systems Halloween morning compromised staff information, the library reported Monday in providing initial investigative findings involving whether unauthorized parties accessed sensitive information.
"Unfortunately, the forensic experts have confirmed that staff information stored on our system as part of our employment practices – namely payroll, human resources, and onboarding — was compromised," Terri Carroll, director of communications, innovation, and strategy, said by email.
"While we have not received any reports of related identity theft since the incident was discovered, a comprehensive slate of services from IDX, a leading identity protection technology company, will be made available to staff," Ms. Carroll reported.
The cyberattack hit Oct. 31, and the library’s network connection unexpectedly went down, making the library’s website, its supplementary Hoopla and Overdrive programs, and internet access on public computers and Wi-Fi unavailable.
On Nov. 15, the library system announced that its computers, Wi-Fi, and catalog functions were back up and running. The announcement came two weeks after the network outage, which was deemed a “targeted cybersecurity incident” by library officials.
In her update Monday, Ms. Carroll reported that in the next two weeks the Toledo Lucas County Public Library expects a summary report of the investigation into what she called "a sophisticated cyber attack against its network."
"An unauthorized party gained access to our network environment and encrypted our data," she wrote. "Our IT professionals immediately secured the network upon discovery of the compromise. We then retained professional, independent forensic experts to investigate the extent of the unauthorized activity and ensure that our environment was secure."
The identity protection technology company services now being made available to library staff include at least 12 months of credit monitoring, depending on residence, and fully managed ID theft recovery services, Ms. Carroll wrote.
The Toledo Lucas County Public Library system has just under 400 employees, Ms. Carroll estimated Monday night.
"It would be all of our staff," she said by telephone when asked how many of them might be affected. "It would be everyone because it was one database."
First Published December 27, 2021, 10:48 p.m.