Ransomware virus discovered in P.E.I. government network was active for 90 minutes, according to province

The province says a virus that was recently discovered on its government computer network, which it's describing as ransomware, was active for 90 minutes Sunday afternoon.

Ransomware is a type of malicious software, or malware, that blocks access to a computer system or data, usually through encryption, until the victim pays the attacker and receives a key to undo the encryption, according to John Brennan, director of business infrastructure services with the province.

"We noticed some unusual activity on the government network. We took some investigative measures late morning and at approximately one o'clock a virus started to encrypt some of our infrastructure in the network," said Brennan.

"Our staff took steps to protect the network and fight back the virus, so the virus ran for approximately 90 minutes. We totally contained it and stopped its activity at approximately 2:30 p.m."

Brennan said a very small amount of the government's server infrastructure became encrypted during the incident, but all the affected data is backed up and protected.

"Our basic process is we backup all our data independently every day. So we have all our data secure," he said. "We are in the process now of investigating the network and ensuring that the virus has been fully removed."

The government has not been in contact with whoever launched the attack on the government servers.

Minimal service disruption

The province alerted the public of the malware discovery in a press release on Tuesday evening. The release said the government felt the public should be made aware of the discovery, "and reassured that security of their information is extremely important to the government."

Brennan said officials were able to stop the virus very early and though there were some small service interruptions on Monday, most applied to internal government services. 

He said as of Tuesday morning all services returned to normal and the public should not have experienced interruptions as a result of the ransomware event. 

"Being government, we have a robust security and backup environment so we're better positioned than most organizations to deal with such events," Brennan said.

"We're very sensitive as stewards of citizen data and we're going to take all the appropriate time required to ensure that it's protected," he said. "We are still investigating and we will take it very seriously."

How the virus got into the government system remains unconfirmed, but Brennan said the malware came from outside of Canada.

He said the province has partnered with federal cyber-security organizations as well as Microsoft, McAfee and Dell to do a review of the entire network to ensure that the virus has been removed.

Officials say Islanders may experience slower services for a few more days as efforts are ongoing to ensure the elimination of the malware.

More from CBC P.E.I.