City of Saint John begins legal action against insurer over cyberattack damage

The City of Saint John is taking its insurer to court over the costs of a cyberattack two years ago.

City council formally approved the lawsuit against AIG Canada at Tuesday night's council meeting.

The details of the reasons behind the lawsuit are not known, having been discussed in council's closed meeting before the open session.

Mayor Donna Reardon, reached by phone after Tuesday's council meeting, declined to comment on the legal matter.

On Nov. 13, 2020, cybercriminals hacked and held city hall for ransom.

The city lost access to phones, emails and its own website and could not retrieve information on things such as parking payments and building permits.

Its emergency call centre also lost access to its computers, forcing 911 calls to be rerouted through Fredericton.

Thousands of hours of work was lost on servers and devices.

The ransomers were said to be demanding as much as $20 million worth of bitcoin to release the city's network.

City Hall refused to pay and instead rebuilt its entire network from scratch.

In April 2021, CBC News reported that the effort cost Saint John $2.9 million, with the city saying $2.5 million would be covered by two insurance policies with AIG.

The city had hoped to have its network rebuilt by June of that year, but effects of the attack lingered.

Throughout the summer of 2021, employees were unable to print from their computer stations and police could not generate information such as crime statistics.

It's not known if costs of the network restoration have continued to grow since, but a city spokesperson said in the fall of 2021 that recovering from a cyberattack fully "could take years."

Lawsuits against insurance companies are not uncommon and are often seen as a step in the negotiation process.

In Canada, it is estimated 90 per cent of the lawsuits never go to trial.