Hamilton hit by ransomware attack, city says for 1st time since incident paralyzes services

Hamilton is experiencing a ransomware attack, which has had sweeping impacts on city services for over a week. 

City manager Marnie Cluckie named the nature of the cyber attack for the first time during a virtual call Monday afternoon, alongside Mayor Andrea Horwath. The call was the city's first media conference since the breach began on Feb. 25. 

The incident has shut down almost all city phone lines, paralyzed city council and impacted dozens of services including the bus schedule app, library WiFi and permit applications.

The city hasn't provided a timeline for when the situation will be resolved.

"It's impossible to know how long it will take us to get fully up and running again," Cluckie said.

"I can tell you that we will only restore systems when we are confident we can do so safely and securely." 

The city does not believe personal data has been accessed, she said. Hamilton police have been notified and will be investigating.

Cluckie said she's been tightlipped about what's happening behind the scenes as the situation is "sensitive" and would not reveal the amount of money the attackers are asking for or where they're located. 

The city has insurance coverage for cybersecurity breaches, she said. 

It's hired cybersecurity experts at Cipher to respond to the attack, Cluckie said. Cipher is providing forensics and incident response, as well as legal services. 

Ransomware is a type of malicious software that "denies a user's access to a system or data until a sum of money is paid," according to the Canadian Centre for Cyber Security. 

The centre, run by the federal Communications Security Establishment, said impacts of ransomware attacks can be "devastating" to the organization involved. 

"Threat actors have become more covert in their operations by first gaining access to an organization's infrastructure, including their communications systems, to identify critical systems, high-value data, personal information, and data that could cause reputational damage if leaked to the public," it said. 

Paying the ransom doesn't guarantee the system will be restored, said the agency.