On July 10, 2022, the Toronto Symphony Orchestra (TSO) and the Canadian Opera Company were notified by its email provider – WordFly – that a network disruption had occurred and this rendered the technology inaccessible. Also impacted was performing arts company Canadian Stage.
Often the first signs of a ransomware attack is an abnormal spike in disk activity. This occurs as the malicious software parses every folder for data to encrypt. A secondary sign is with the impacted system becoming less responsive.
TSO has reached out to its customers in what is describes in email correspondence as “the spirit of full transparency and in abundance of caution”.
It later came to light that WordFly was subject to a ransomware attack, with the impacted period being July 10th to 14th. The cyberattack involved the exporting of customers’ information from the WordFly environment. While financial information was not in scope, some personally indefinable information was impacted.
This related to customer name, email address, Patron ID and other information about the customer’s TSO account. For those customers who had responded to surveys, additional information that was affected includes demographic information (such as age range, gender, ethnicity).
To date, there is no indication that the data has been misused for any purpose by this attacker. The resolution of the incident resulted in the data being deleted from the attacker’s possession. This leads to a low risk assessment.
The impacted arts organisations are big players in the Canadian cultural scene. The Canadian Opera Company is the largest opera company in Canada and one of the largest producers of opera in North America, performing within its own opera house, the Four Seasons Centre for the Performing Arts, and through tours. The Toronto Symphony Orchestra performs at Roy Thomson Hall and it was established in 1906.
Canadian Stage is one of Canada’s largest not-for-profit contemporary theatre companies, founded in 1987. Canadian Stage has produced more than 300 shows, with an emphasis upon performances of Canadian plays.
With WordFly not yet back as an active service, the TSO is working with Mailchimp to enable communications with its customers continue.
For those impacted, and for anyone else impacted by a similar incident, it is important to be vigilant to the risks of phishing, such as suspicious emails, text messages, or telephone calls. Businesses can aim to lessen the impact through using good monitoring applications, together with practicing frequent file backups, running anti-malware software, and ensuring that effective user training is in place.
