Kingston Police Got Hacked. Good News, the Hacker Pinky Swore.

Pillar 01 · Security

On New Year’s Day 2025, while the rest of us were nursing hangovers, someone logged into the Kingston Police network. Through the VPN. With a real username and a real password. Like an employee. A very motivated employee working a stat holiday.

How did they get the password? Nobody knows. Police checked. Still nobody knows. Maybe it was on a sticky note. Maybe it was “Kingston2024!” We’ll never find out, and frankly that’s the most honest sentence in the whole release.

Two days later it was a “network issue.” Then it got promoted to a “cyber incident.” Then it went quiet for twenty-one months, like a teenager who dented the car.

Last Friday we got the details. Friday afternoon. The official time slot for news you’d love everyone to skip.

So what left the building? 160 GB. About 345,000 documents. Police helpfully sorted out the “duplication and junk,” which is the first time I’ve seen a breach notice brag about its filing hygiene. That leaves around 100,000 documents that matter.

Court dockets back to 2009. Bail lists covering roughly 68,000 adults and young offenders. A mystery bag from 1998 to 2020 touching about 80,000 people. Victims. Witnesses. Complainants. Missing persons. Cops. Basically anyone who ever made eye contact with Kingston Police for two decades. Names, birthdates, charges, pleas, sentences. The full director’s cut.

1998. Some of that data is old enough to rent a car. It was still online, still reachable, still waiting patiently for its big day.

Now the reassurance. The risk of misuse is “low.” Why? Partly because of the passage of time. I love this. Apparently stolen data has a best-before date. Like yogurt. Leave a witness list in the fridge long enough and it turns harmless. Somebody alert the dark web.

And it gets better. The data was deleted. There’s proof of deletion. What kind of proof? They won’t say. From whom? Well. Only one party can prove they deleted stolen data, and it’s the party that stole it.

So the official position is: a criminal broke into a police service, took 100,000 files, and then kindly confirmed they threw them out. Case closed. If that’s the standard, I’d like to report my bike stolen and also accept the thief’s assurance that he’s not riding it.

CBC asked the chief for an interview. They got a statement about trust and transparency. Nothing says transparency like declining to talk about it.

Mechanism time

Because this will happen again somewhere and the press release is already half written.

One password. One VPN. 160 GB out. That means the network said “valid login? Come on in, take whatever you want, files are readable, help yourself to the mints.” The entire security model was the front door lock. Turns out somebody had a key.

Back in January 2025 Kingston Police said no security measure makes a network completely invulnerable. Correct. Also a bit like saying no seatbelt survives every crash, so why wear one. The goal is simpler. Stolen data should be useless to the thief. Encrypt it at the object level, keep the keys somewhere the burglar can’t stroll into, and 160 GB of exfiltration becomes 160 GB of gibberish. Then nobody needs a pinky swear.

And retention. If you don’t need 1998 records online in 2025, delete them. Yourself. On purpose. Before a stranger does it for you and sends a receipt.

Kingston drew the short straw this week. Plenty of police services, cities and health agencies in this country run the exact same playbook. Trust the login. Hoard everything. Hope nobody notices.

Questions for every board this week

• Who holds our keys, and do they live in the same house as the data?
• If someone walks off with a copy tomorrow, can they read it?
• What are we keeping just because nobody got around to deleting it?
• Is our incident response plan “ask the attacker nicely”?

80,000 people are now relying on the honour system. With a hacker. I’ve met more trustworthy contracts on a napkin.

Bias declaration. I founded SkyeConnex. We build data custody infrastructure so stolen data stays unreadable, even to whoever’s hosting it. So yes, I have skin in this. I also have eyes.