The Wi-Fi That Wasn’t the Library’s: How a Fake Login Page Harvested a Prince George Library’s Patrons

PRINCE GEORGE, B.C. — November 1, 2026 — The Wi-Fi login page looked exactly right. It carried the library’s colours, it asked for a library card number and PIN, and it connected visitors to the internet in seconds. For regulars at Sprucewood Public Library, the fictional Prince George library at the centre of the story, there was no reason to doubt it — until staff realised the page was not theirs at all.

The network had appeared beside the library’s real Wi-Fi, with a name only one word different. Patrons who joined it were taken to a copy of the library’s sign-in screen, typed in their credentials, and were passed through to the internet as normal. Nothing failed. Nothing looked broken. The theft happened in the moment that looked most ordinary.

The login page had not been hacked. It had been imitated.

According to the fictional library’s account, the fake network was discovered only when a staff member noticed two nearly identical network names on her own phone and asked a colleague which one was real. By then, the library estimates, dozens of patrons had signed in through the copy over several days. Some had also reused the same PIN elsewhere, which is where a library login stopped being a library problem.

“We offer free Wi-Fi because people need it — for job applications, for homework, for staying in touch,” said Clara Beaumont, Sprucewood’s fictional library director. “Nobody should have to be a security expert to sit down with a laptop in a public library. But someone set a trap in the one place people expect to be safe, and it looked exactly like us.”

Public Wi-Fi is a quiet, growing target for credential theft.

Cybersecurity advisors say fake hotspots — sometimes called evil twins — are attractive precisely because they require no break-in. An attacker only needs a small device, a network name close enough to the real one, and a login page copied from the genuine sign-in screen. Visitors do the rest themselves, willingly handing over credentials to a page they believe they have used before.

“The page did exactly what it was designed to do. It asked, politely, for a login,” said one cybersecurity advisor familiar with public Wi-Fi cases. “People are trained to sign in to Wi-Fi. The attacker did not need to defeat any security — they only needed to be the first network a phone offered, with a name that looked familiar enough not to question.”

In this fictional case, the damage was not a single dramatic breach. Patrons’ library accounts were accessed, holds were changed, and a handful of people who reused their library PIN as a password elsewhere found other accounts probed as well. The library says no financial information was stored in its system, but the incident still forced it to reset credentials, warn patrons, and explain to regulars why a page they trusted had not been its own.

Sprucewood says it has since changed how its Wi-Fi works. The real network name is now posted at every entrance and on every table, staff can confirm it on request, and the sign-in page no longer asks for a full library card number and PIN on public Wi-Fi — a simpler guest pass is issued at the desk instead. The library has also added a warning to its login screen: if a sign-in page appears before you have chosen the network name posted in the building, stop and ask staff.

The fix, experts say, is deliberately unglamorous: check the network name before you check the login box.

That advice applies well beyond one library. Across Canada, libraries, community centres, cafés, and transit hubs offer free Wi-Fi that visitors join without a second thought, and most of those networks are easy to imitate with a similar name. The defence is not better Wi-Fi. It is proof of which network is real.

For public spaces, the checklist is short: post the exact network name where people can see it, never ask for sensitive credentials on a public Wi-Fi login, and give staff a simple script for the question “is this your Wi-Fi?” For visitors, it is equally simple: join only the network name posted in the building, never reuse a PIN or password from another account on a Wi-Fi login, and if a login page appears unprompted, close it and ask staff before typing anything.

Sprucewood says patron credentials caught in the fake sign-in have been reset, and the library is working with its internet provider to monitor for lookalike networks near the building.

The page looked like the library’s. The network name almost was. And the difference — one word, checked against a sign on the wall — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.