Hamilton hit by ransomware attack, city says for 1st time since incident paralyzes services

Hamilton is experiencing a ransomware attack, which has had sweeping impacts on city services for over a week. 

City manager Marnie Cluckie named the nature of the cyber attack for the first time during a virtual call Monday afternoon, alongside Mayor Andrea Horwath. The call was the city's first media conference since the breach began on Feb. 25. 

The incident has shut down almost all city phone lines, paralyzed city council and impacted dozens of services including the bus schedule app, library WiFi and permit applications.

The city hasn't provided a timeline for when the situation will be resolved.

"It's impossible to know how long it will take us to get fully up and running again," Cluckie said.

"I can tell you that we will only restore systems when we are confident we can do so safely and securely." 

The city does not believe personal data has been accessed, she said. Hamilton police have been notified and will be investigating.

Cluckie said she's been tightlipped about what's happening behind the scenes as the situation is "sensitive" and would not reveal the amount of money the attackers are asking for or where they're located. 

The city has insurance coverage for cybersecurity breaches, she said. 

It's hired cybersecurity experts at Cypfer to respond to the attack, Cluckie said. Cypfer is providing forensics and incident response, as well as legal services. 

Ransomware attacks can be 'devastating'

Ransomware is a type of malicious software that "denies a user's access to a system or data until a sum of money is paid," according to the Canadian Centre for Cyber Security. 

The centre, run by the federal Communications Security Establishment, said impacts of ransomware attacks can be "devastating" to the organization involved. 

"Threat actors have become more covert in their operations by first gaining access to an organization's infrastructure, including their communications systems, to identify critical systems, high-value data, personal information, and data that could cause reputational damage if leaked to the public," it said. 

Paying the ransom doesn't guarantee the system will be restored, said the agency. 

Other municipalities have faced ransomware attacks in recent years.

When the small southwestern Ontario town of St. Marys fell victim to a cyberattack in 2022, lawyers advised the municipality to pay a ransom of $290,000 in cryptocurrency.

Al Strathdee, mayor of the town with about 7,000 residents, said the potential risk to people's data was too high not to pay up. The town reported spending at least $1.3 million to investigate and recover from the attack.

The City of Stratford agreed to pay an attacker more than $75,000 worth of Bitcoin in exchange for decryption keys to unlock its information systems following a ransomware attack in 2019.

In a 2020 conversation with a director at Toronto Metropolitan University's cybersecurity hub, Stratford's then-mayor Dan Mathieson said the breach remediation cost was "upwards of a million dollars."

Watch: The Toronto Public Library is still recovering after a major ransomware attack

When ransomware hackers go after the public library

9 months ago

Duration 6:00

A ransomware attack in October took many of the Toronto Public Library’s services offline for months. CBC’s Anya Zoledziowski breaks down the library’s efforts to rebuild its services and examines why hackers may have targeted it in the first place.

On Monday, Horwath told reporters once the city's systems have been restored, Cluckie will conduct a full review to understand how the breach happened and take measures to prevent it from happening again.

All council meetings have been cancelled until at least March 15 as staff don't have the capacity to work on daily operations as if it were business as usual, Horwath said. 

Council is fortunate the agendas were light leading into March Break, Horwath said. But they're also "very cognizant" the longer they delay meetings, the more work there will be to catch up on later.

Services impacted

Here's how services are impacted, according to the city: 

Phone lines

• All program and councillor phone lines are down.

• Provincial Offences Administration phone lines are down.

• The main phone lines for long-term care homes Macassa and Wentworth lodges aren't working.

• The Customer Contact Centre is operational, with delays, and can be reached at 905-546-2489. 

Online systems 

• Payments aren't possible for fire prevention service requests, open air burn permits, dog licensing, animal services donations or business licensing and permits. 

• Several services aren't available including for building permits, zoning verifications, property reports, job applications, marriage licenses or public health inspection results. 

• The farmers' market website is down.

Engineering Services 

• Permits aren't available for road closures, sidewalk closures, encroachments, utility installations or excavation permits unless they were submitted before Feb. 25.

• Online drawing requests are also on hold.

Cemeteries

• Genealogical information is not available.

• Some service delays are expected for burials and sales. 

Libraries

• Branches are open, borrowing is available, the website is working and in-person programs are running.

• Unavailable services include wifi, public computers, printing, borrowing using the library's online catalogue, shelf-check kiosks, virtual programming, help with tech devices makerspaces and extended access.

Public health

• Workers are unable to access updated student vaccine records being sent by fax or phone and have postponed suspending those with overdue vaccines. 

Property taxes 

• Payments can be made at financial institutions or by mail.

• Municipal Service Centres will accept cash payments.

• Pre-authorized payments may be delayed.

• Tax certificates for real estate closings aren't available to lawyers.

• Online tax tools are offline including the eBilling Portal, Property Inquiry Tool and Hamilton's tax website.

Ontario Works and special supports

• Monthly payments will be issued as scheduled.

• Communications through phone and online are impacted. 

• Residents inquiring about funeral benefits are advised to visit the office at 1550 Upper James St. 

City vendors

• Vendor payments are being processed manually so expect delays.

• Invoices can be sent to the city using normal processes.

Transfer stations and community recycling centres

• Only cash is accepted. 

• Online tools aren't working for replacement bin applications, bulk pickup requests, special consideration requests and ordering additional trash tags. 

Child care

• Fee subsidy offices are closed but staff remain available to support clients.

• Red Hill Family Centre is fully operational except for the phone lines.

• Therapeutic referral intake cannot receive faxed forms, but can receive emails.

• The online Child Care Registry is not available.

Transit

• HSR now app is offline and PDF schedules are available on city's website.

• HSR email and phone lines aren't working. 

• Bus operators don't have access to computerized onboard schedules.

• Bus stop annunciators aren't operational. 

• Online booking for on-demand transit in Waterdown is working, as is PRESTO payments and DARTS services.

Hamilton Water

• Customer service programs are impacted and delays should be expected.

City mapping

• Website maps are not viewable, including interactive zoning mapping and find my ward.

Recreation

• Recreation and senior centres, arenas and golf courses are fully operational except for phone lines. 

• The Senior Centre Without Walls program is cancelled. 

• The pool at Kanétskare Recreation Centre is closed as the emergency phone line is not working.

• Registration for the city's spring recreation programs has been paused until further notice.