In an internal email to employees obtained by Global News, staff were told the attackers accessed network drives that contain payroll information and social insurance numbers.

"Your network has been ATTACKED, your computers and servers were LOCKED, your private data was DOWNLOADED," reads a demand letter sent to TransLink.