Key takeaways
- On October 2, 2026, Kingston Police closed out a January 2025 intrusion: a threat actor entered via the VPN application with compromised account credentials, encrypted and extracted 160 GB, then provided proof of deletion.
- The notice is candid about forensic limits: the stolen dataset was corrupted in extraction, record-by-record review was impossible, and the five categories are the best available picture, not a complete accounting.
- Twenty-one months passed between discovery and this public notice, and the “low likelihood of misuse” conclusion rests largely on dark-web monitoring. Read this as a drill: write your notification timeline before the incident, and keep retention tight enough that a 1998 file cannot leave in 2025.
What the notice says, and what it admits
On October 2, 2026, Kingston Police published a closing notice on the incident its Acting Director of IT discovered on January 3, 2025. The facts: on January 1, 2025, a threat actor used compromised account credentials to enter Kingston Police systems through the service’s VPN application. The investigation never determined how the credentials were compromised. Systems were shut down quickly, but 160 GB had already been encrypted and extracted.
The notice deserves credit for what it admits. Experts engaged the threat actor, who agreed to delete the data and shared proof of deletion. Nine months of dark-web monitoring with the OPP and policing partners found no evidence of disclosure. Kingston Police concludes misuse is unlikely, then says plainly that it “cannot be definitively ruled out that copies of the information were retained by the threat actor or disclosed elsewhere.”
Most breach statements stop at the monitoring claim. This one states the limits of its own evidence.
What left, as best as anyone can tell
The forensics are the most instructive part. Of 345,000 extracted documents, analysts culled duplicates and junk to about 100,000. Then the real problem: the dataset was significantly corrupted during extraction, so a record-by-record review was impossible. Experts sampled instead, and the notice warns the categories below “should not be interpreted as a complete accounting.”
| Category | Period | Estimated individuals |
|---|---|---|
| Criminal court information: name, date of birth, offence details, plea, findings, sentence or other disposition | 2009-2024 | About 51,000 |
| Provincial offence ticketing: name, date of birth, offence details, plea, finding, sentence or other disposition | 2012-2024 | 50,000-100,000 |
| Bail hearing lists, adults and young offenders: name, date of birth, remand details | 2009-2022 | About 68,000 |
| Excel reports: victims, witnesses, complainants, missing persons, KP employees and police officers; names, dates of birth, offence details | 2000-2023 | About 22,000 |
| Remaining data: 2,000 driver licence numbers, fewer than 1,000 social insurance numbers (likely employees), fewer than 250 persons’ credit card, health card or passport numbers | 1998-2020 | About 80,000 |
Two observations. First, the age of the data: files back to 1998, dockets from 2009, bail lists from 2022. A 2025 breach exposing late-nineties records is a retention-schedule failure as much as a security failure. Second, the mix: victims, witnesses, complainants, and missing persons sit in the same set as people charged or convicted. For those groups, breach harm is not identity theft alone. It is retaliation risk.
Twenty-one months, and the “low likelihood” claim
The intrusion was found on January 3, 2025. The public notice is dated October 2, 2026. That is 21 months of investigation before the people whose records were taken were told what was taken.
There were legitimate reasons for a long clock. The incident ran as an active investigation; analyzing a corrupted 160 GB dataset took real time; the IPC, the Solicitor General, the Inspector General of Policing, the OPP, and the RCMP were informed first. Privacy teams should not read this as negligence on its face.
But they should read it as a planning input. The people on those bail hearing lists spent 21 months not knowing their name, date of birth, and remand details were in a stolen dataset, while the notice concedes misuse “cannot be definitively ruled out.” Write the rule for when interim notice goes out, even with forensics incomplete, before the next incident.
Then there is the evidence behind “low likelihood.” Dark-web monitoring is real, and nine months with no hits is genuinely reassuring. But it detects only re-disclosure on watched markets, not a quiet buyer sitting on a corrupted dataset, and not targeted extortion of the victims, witnesses, and complainants in the spreadsheet category. The notice says this in careful language. Teams citing “no evidence of misuse” should imitate the candor along with the headline.
The entry vector and the budget line
Entry was through the VPN application with compromised account credentials, and the investigation could not determine how they were compromised. That is a standing argument for phishing-resistant multi-factor authentication on every remote-access path, and credential monitoring that catches reuse first.
And the budget line is unusually public. The Kingston Police Services Board plans to invest $3.9 million over three years in cybersecurity and IT infrastructure, growing full-time IT staff from four to six. That is the real cost of the incident, printed in a media release. When your next security budget proposal stalls, this notice is a comp.
Actionable takeaway: Run your breach-notification clock as a drill this quarter. Time your last incident from discovery to draft notice, and write the rule for when interim notice goes out with forensics incomplete. Check whether your data map could enumerate what left; a corrupted exfiltration dataset is the real test. And confirm your retention schedule assigns the oldest files a destruction date the way it assigns a collection date. Kingston Police spent 21 months being thorough. Whether that was fast enough is a question the people on those lists get to ask, and your team’s answer belongs in the playbook, written before it is ever needed.