City says it recorded 89,737 calls without residents' knowledge

Close to 90,000 telephone calls people made to the City of Hamilton were recorded without their knowledge over a six-month period. Officials say the calls were securely stored and not inappropriately accessed.

They have been less clear about why it took three months to inform the public.

In a statement on its website, the city said 89,737 phone calls were recorded without caller authorization between March and August 2024, after its telephone system was disabled during the Feb. 25 cyberattack on the city that disrupted numerous public systems.

As an emergency solution, the city said it used an alternate phone system that was in testing for future use. The phones were supposed to play a voice message notifying callers that they were being recorded. However, the city did not verify that this voice message had been activated on 11 public-facing telephone lines.

The city said staff turned off the recording function on impacted lines when they discovered the issue on Aug. 15. In the time since, they reactivated the phones with the appropriate notice of recording. 

Hamilton records calls for quality assurance and training, the city said, adding that only some staff can access those recordings.

CBC Hamilton asked whether inappropriately recorded calls were used for training but did not receive a response. 

The city said it stored the recordings during the investigation and will delete them. 

Manager says telling the public was less important than completing investigation

CBC Hamilton also asked why the public was not informed when leaders learned about the breach.

"Cyber incidents and the related investigations are complex and take time to resolve," city manager Marnie Cluckie said in an email response. 

She said once a city investigation confirmed there was no evidence of someone inappropriately accessing the phone calls, the focus shifted to "understanding the scope of the breach." 

"Had there been evidence of disclosure or inappropriate access of personal information, notification would have taken precedence over completing the investigation," Cluckie said. 

CBC Hamilton followed up to ask how long the investigation took but did not immediately receive a response.

The city eventually posted about the breach on its website, at their accountability and transparency page. The also posted on social media but did not inform local media through a news release.

How people might be affected

Cluckie said the city reported the breach to the office of the Information and Privacy Commissioner, which provides oversight on how Ontario public institutions use private information.

"There is no action currently required for users of City services," she said.  

The impacted lines directed callers to general inquiries and various city departments, including:

• Animal Services

• City Housing

• Facilities

• Hamilton Water

• Licensing

• Property Standards

• Ontario Works (OW) and OW Special Support

• Provincial Offences Administration (POA)

• Recreation

• Vaccine Records

"The City of Hamilton regrets this error and any inconvenience or distress it may have caused," Cluckie said. "We take the protection of individuals' personal information very seriously and are committed to upholding the highest standards of privacy and accountability to prevent similar incidents in the future." 

Cluckie did not say what actions may have been taken to ensure phones are set up correctly in the future.