Ontario city facing full $18.3M cyberattack bill after insurer denies claim

Hamilton taxpayers are looking at fronting the full cost of a devasting 2024 cyberattack after the city’s insurance company denied its claim.

Hamilton taxpayers are looking at fronting the full cost of a devastating 2024 cyberattack after the city’s insurance company denied its claim.

Councillors were told at the general issues committee meeting on Wednesday that the city’s claim was denied because multi-factor authentication had not been fully implemented at the time of the attack.

According to the city’s insurance policy, no coverage was available for any losses where the absence of multi-factor authentication was the root cause of the cyber breach.

“I understand why Hamiltonians are frustrated — this was a serious and costly breach,” Mayor Andrea Horwath said in a news release Wednesday.

“We expect our public systems to be strong, secure, and dependable. This incident highlights that the city fell short of that standard — and we’re not okay with that.”

On Feb. 25, 2024, Hamilton experienced a cyberattack that disabled roughly 80 per cent of its network and impacted services like business licence processing, property tax, transit planning and finance and procurement systems for weeks.

A few systems were unrecoverable, the city said, including permit applications and licensing, fire department records management and traffic signal system management.

The attackers launched a complex ransomware attack through an external internet-facing server, the city said. After covertly studying the city’s systems, they encrypted systems and data to render them unusable and attempted — but failed — to destroy all the city’s backups.