City believes personal data is safe during Hamilton cyberattack. Experts say that's unusual

In the two weeks since a ransomware attack against the City of Hamilton downed multiple city services, officials have maintained they believe no personal information has been compromised. 

"That's nice to believe and I like to think that unicorns still exist somewhere in the world, but I don't think it's very likely," hacker and cyber expert Jayson E. Street told CBC Radio's Day 6 this past week, reflecting on the case. 

Local officials have been tight-lipped about the hack, saying the sensitive nature requires discretion. But cybersecurity experts tell CBC that generally, it's rare for personal information to be spared in an attack like this.

Street said that often, criminals will not only steal and ransom data, but copy it and extort targets by threatening to release it publicly. Street gets hired to test companies' defences by trying to hack through them using methods such as fake websites, or deceiving workers to gain physical access to computers and restricted areas.

He says cities' systems have too many access points to count, and hackers can exploit all of those.

The city hasn't shared how ransomware got into its system, but that sort of software generally works by blocking a user from accessing their system or data until they pay a sum of money. According to the Canadian Centre for Cyber Security, it's likely the most disruptive form of cyber crime and can take out entire systems. 

Calvin Chrustie, a risk consultant and former RCMP senior operations officer, previously told CBC Hamilton that the city "would be considered extremely fortunate if they [the attackers] didn't have access to some personal data in a situation like this."

CBC Hamilton asked officials if they still believe personal information to be safe, how confident they are and why. A Hamilton spokesperson did not respond by deadline. 

On Feb. 25, the cyberattack shut down most city phone lines, paused council and committees — meetings are set to restart March 27 — and disrupted services including the library, bus schedule app and payment processing.

City manager Marnie Cluckie has said it's "impossible to know" how long it will take to get operations back.

In an email Monday, a city spokesperson told CBC Hamilton the municipality is delayed in processing approximately $36 million in pre-authorized property tax payments, "until such time as services are restored."

On Tuesday, Mario Posteraro, president of OPSEU Local 256 which represents over 450 paramedics, was one of several union leaders who shared ways in which the attack is affecting their members.

He said some workers haven't been able to get paid for overtime work and have concerns about whether their personal information has been breached.

As an employer and through its programs, the city collects a wide range of information, from worker banking data to addresses of families who use services like recreation centres and housing support.