Ransomware attack behind Hamilton cybersecurity incident

Published March 4, 2024 at 6:42 pm

Hamilton City Hall

Hamilton’s recent cybersecurity struggle, which crippled some city services, was caused by a ransomware attack, the city confirmed in a press conference.

The city was struck on Feb. 25, resulting in several service disruptions. Almost all city phone lines went down. Hamilton Street Railway lost their computer systems and stop announcer’s voice. However, HSR was able to continue operations without the onboard computers. The myRide system in Waterdown and DARTS specialized busses remain operational.

The attack also led to the shutdown of recreation program registration and closed some recreation centres. It additionally delayed suspensions for unvaccinated students and affordable housing city meetings.

Numerous online services are also down including;

Fire Prevention Service Request (inspections, file search, education, etc.)
Open Air Burn Permits
Dog Licensing (new & renew)
Animal Services Donations
Business Licensing and Permit Payments
Online Building Permits
Online Zoning Verification/Property Report Application
Job Applications Portal
Marriage License Online Application
Public Health Inspection Results (Food Safety, Public Pools & Spas, Personal Services etc.)

After the attack, Hamilton began an investigation into the circumstances. A city update confirmed information was accessed but it was too early in the investigation to determine what kind of information.

On March 4, Mayor Andrea Horwath and City Manager Marnie Cluckie held a press conference in which they disclosed the nature of the attack for the first time. Horwath said the city staff first detected the attack and “acted immediately” to contain it. Cluckie added the city contacted outside cybersecurity experts, the city council and the appropriate authorities such as Hamilton Police.

She said staff have “literally been working around the clock day and night to respond to the situation and to ensure that full services are up and running as soon as possible. That work is ongoing but they have been working extremely extremely hard.” She said this work was ongoing as she spoke.

Cluckie continued saying, “It is impossible to know how long it will take us to get fully up and running again. I can tell you though we restore systems when we are confident we can do so safely.”

She additionally confirmed the attack as ransomware, a software that “denies a user’s access to a system or data until a sum of money is paid,” per the Canadian Centre for Cyber Security.

However, she believed all resident’s personal information remained secure. “As of this moment, we do not believe that people’s data and information has been accessed and we are doing everything we can to keep it that way,” she said

Once services have been restored, Horwath said Cluckie and the City will hold a review to find out how this breach happened. They have also committed to starting new policies to ensure such an attack does not happen again.

However, Cluckie provided no information about who was behind the attack, how the attack happened, how much money the attackers asked for, or if the city considered paying the ransom.

inthehammer's Editorial Standards and Policies advertising