Nunavut government rebuilding network after ransomware attack

The government of Nunavut is rebuilding its communications network after a ransomware attack encrypted its files. 

All Word documents and PDF files the virus had access to are encrypted and unreadable by the government, according to Martin Joy, Nunavut's director of information, communications and technology. 

According to their investigation, Joy said it looks like the ransomware began acting on the government's network around 4 a.m. Saturday morning. By 6:30 a.m. information technology (IT) staff had confirmed the attack. 

"The nature of the government is we're a centralized organization, so it has impacted the file servers of different departments and it's impacted some of our communities as well," Joy said.  He said most departments and communities are affected. 

Ransomware is a type of malicious software that allows hackers to view a computer's files, gather information and spread through its network, unbeknownst to the user.

Then, the virus encrypts the files and the attackers demand payments from victims to release the data.

To contain the attack the government shut down parts of its network. As of Monday afternoon all government employees are still locked out of their accounts. They don't have access to their email or voicemail, but phones are working. 

Minister of Community and Government Services Lorne Kusugak said in a statement in the Legislature Monday that it would be at least a week before services are restored. 

"There is no concern at this time with the loss of personal information or privacy breaches," Kusugak said. 

The virus was likely downloaded to Nunavut's network when an employee, working late on Friday night clicked on a web advertisement or email link, said Joy. 

Joy said security systems in place didn't detect the virus.  The email sent by the ransomware looks like the DoppelPaymer, a newer ransomware that the government of Nunavut's security systems weren't yet trained to detect, Joy said. 

Rebuilding network 

To restore services, the government's IT department has been working to recreate its network from backups.

It keeps monthly and yearly backups as well as taking a nightly snapshot, but the government has not yet confirmed if the backups are affected by the virus.  

Nunavut's communications network reaches all of its 25 communities as well as having a data centre in Ottawa. 

The IT department is rebuilding that system separately from the existing one, so services can come back on line, while it diagnosis the extent of the virus. 

It is working with FireEye — one of the largest security firms in North America, according to Joy — Microsoft, and other cybersecurity experts. 

"The government gets hit about 35,000 times a week. People trying to hack in or ransomware to try to get into our world," Joy said. 

"Every now and again I guess you can't defend against that all. Someone's going to get around you, so then we get to fall back on our other systems."

Nathaniel Alexander, Nunavut's manager of network operations, said security programming is often built with the expectation that organizations will have access to fast internet, which is not the case in Nunavut.   

Working to deliver public services

Government staff were in meetings through the weekend to contain the virus, and departments met to find ways to continue to deliver public services. 

The Department of Family Services is working to figure out how to deliver its programming and social assistance, while the health department has reverted to using paper records, Joy said. 

Joy says internet has been provided to the airports to ensure they can give updates on their runways.

Kusugak said the Departments of Health, Education, Family Services, Justice and Finance are the first priorities.