Hamilton Hit by Ransomware Attack, City Says It’s Crippling Services for the First Time Since the Incident

Hamilton is facing a ransomware attack, which has had major consequences for city services for over a week.

City Manager Marnie Cluckie first mentioned the nature of the cyberattack during a virtual conversation Monday afternoon, along with Mayor Andrea Horwath. The call was the city's first media conference since the breach began on February 25.

The incident shut down virtually all city phone lines, paralyzed the city council and affected dozens of services, including the bus schedule app, library WiFi and permit applications.

The city has not yet provided a timetable for when the situation will be resolved.

"It's impossible to know how long it will take before we can get back to full operations," Cluckie said.

"I can tell you that we will only restore systems if we are confident we can do so safely."

The city does not believe any personal information was accessed, she said. Hamilton police have been notified and will investigate.

Cluckie said she is not aware of what is happening behind the scenes because the situation is "sensitive" and would not reveal how much money the attackers are asking for or where they are located.

The city has insurance coverage for cybersecurity breaches, she said.

The company has hired cybersecurity experts at Cipher to respond to the attack, Cluckie said. Cipher provides forensic investigation and incident response, as well as legal services.

Ransomware attacks can be 'devastating'

Ransomware is a type of malicious software that "denies a user's access to a system or data until a sum of money has been paid," according to the Canadian Center for Cyber ​​Security.

The centre, run by the federal Communications Security Establishment, said the consequences of ransomware attacks could be "devastating" for the organization involved.

"Threat actors have become more stealthy in their operations by first accessing an organization's infrastructure, including their communications systems, to identify critical systems, high-value data, personal information, and data that could cause reputational damage if leaked to the public. " it said.

The story continues

Paying the ransom does not guarantee that the system will be restored, the agency said.

Other municipalities have suffered ransomware attacks in recent years.

When the small southwestern Ontario town of St. Marys fell victim to a cyberattack in 2022, lawyers advised the municipality to pay a $290,000 ransom in cryptocurrency.

Al Strathdee, mayor of the town of about 7,000, said the potential risk to people's data was too great not to pay. The city reported spending at least $1.3 million to investigate and remediate the attack.

The city of Stratford agreed to pay an attacker more than $75,000 in Bitcoin in exchange for decryption keys to unlock its information systems following a 2019 ransomware attack.

In a 2020 conversation with a director of Toronto Metropolitan University's cybersecurity hub, then-Stratford Mayor Dan Mathieson said the cost of remediating the breach was "over a million dollars."

On Monday, Horwath told reporters that once the city's systems are restored, Cluckie will conduct a full review to understand how the breach occurred and take steps to prevent it from happening again.

All council meetings have been canceled until at least March 15 because staff do not have the capacity to work on the day's operations as if it were "business as usual," Horwath said.

The Council is fortunate that agendas have been light leading up to March Break, Horwath said. But they are also 'very informed'. The longer they postpone meetings, the more work there will be to catch up.

Services affected

According to the city, services will be affected as follows:

Telephone lines

• All program and council phone lines are down.

• The telephone lines of the provincial administration for violations are down.

• The main phone lines for the Macassa and Wentworth long-term care lodges are not working.

• The Customer Contact Center is operational, subject to delay, and can be reached at 905-546-2489.

Online systems

• Payments are not accepted for applications for fire prevention services, outdoor burn permits, dog licenses, animal shelter donations, or business licenses and permits.

• Several services are unavailable, including for building permits, zoning verifications, real estate reports, job applications, marriage licenses, or public health inspection results.

• The farmer's market website is offline.

Technical services

• No permits are available for road closures, sidewalk closures, encroachments, utility installations or excavation permits unless submitted by February 25th.

• Online drawing requests are also on hold.

Cemeteries Libraries

• Branches are open, borrowing is possible, the website works and personal programs are running.

• Services not available include Wi-Fi, public computers, printing, borrowing through the library's online catalog, shelf check kiosks, virtual programming, tech device makerspace assistance, and expanded access.

Public health Property tax

• Payments can be made at financial institutions or by post.

• Municipal Service Centers accept cash payments.

• Pre-authorized payments may be delayed.

• Tax certificates for real estate closings are not available to attorneys.

• Online tax tools are offline, including the eBilling portal, the Property Inquiry Tool and Hamilton's tax website.

Ontario Works and Special Supports

• Monthly payments are made as scheduled.

• Communication over the telephone and online is affected.

• Residents inquiring about funeral benefits are advised to call the office at 1550 Upper James St.

City vendors Transfer stations and community recycling centers

• Only cash is accepted.

• Online tools do not work for replacement bin requests, bulk collection requests, special consideration requests, and ordering additional waste tags.

Childcare

• The fee subsidy offices are closed, but staff remain available to support customers.

• Red Hill Family Center is fully operational except for phone lines.

• Therapeutic Referral Intake cannot receive faxed forms, but can receive emails.

• The online Childcare Register is not available.

Transit

• The HSR app is now offline and PDF schedules are available on the city's website.

• HSR email and phone lines are not working.

• Bus companies do not have access to automated timetables on board.

• Bus stop announcers are not operational.

• Online booking for on-demand transit in Waterdown works, as do PRESTO payments and DARTS services.

Hamilton water City maps Recreation

• Recreation and senior centers, arenas and golf courses are fully operational except for phone lines.

• The Senior Center Without Walls program is cancelled.

• The swimming pool at the Kanétskare recreation center is closed because the emergency telephone line is not working.