Kingston is the city Ottawa drivers pass on the Highway 401 run, and its police service has now spelled out what a hacker took from its systems in January 2025. Kingston Police published a public notice on October 2, 2026 about the cybersecurity incident, and the numbers are large.
What was taken
According to the notice, the threat actor extracted 160 GB of data. That was 345,000 documents, which came down to about 100,000 once duplicates and junk were removed.
The intruder got in on January 1, 2025 using compromised VPN credentials. The intrusion was discovered on January 3, 2025, when all systems were shut down.
Whose information is involved
The notice breaks the affected data into groups:
- Criminal court information: about 51,000 individuals, covering 2009 to 2024. It includes names, dates of birth, offence details, pleas, findings and sentences.
- Bail hearing lists: about 68,000 people, covering 2009 to 2022. It includes names, dates of birth and remand details.
- Everything else: the remaining data includes about 2,000 driver licence numbers and fewer than 1,000 social insurance numbers.
The notice, as summarized here, does not say where the affected people live, so it is not clear how many of them have any link to Ottawa.
What police say about the risk
Kingston Police say they believe the likelihood of misuse or disclosure of the extracted information is low. They point to nine months of dark web monitoring, which found no evidence that any of the extracted data was disclosed.
Police are also candid about the limits of that comfort. The notice says it cannot be definitively ruled out that copies of the information were retained.
Who was told, and what changes
Kingston Police reported the incident to the Information and Privacy Commissioner of Ontario, the Ontario Solicitor General, the Inspector General of Policing, the OPP and the RCMP, according to Kingstonist's report on the force's completed internal investigation.
Looking ahead, the Kingston Police Services Board plans to invest $3.9 million in cybersecurity improvements over three years. It also plans to increase IT staff from four to six positions.
Earlier this month
You can read ottown's earlier report for that story.
What we don't know yet
The facts available do not say how the compromised VPN credentials were obtained, or whether the force has identified the person or group responsible. They also do not say whether affected people are being contacted individually. Anyone who thinks they may be affected should check the notice on the Kingston Police website directly.
Sources: Kingston Police, Kingstonist
