Almost 5 months after major cyberattack, Hamilton’s mayor says work is 'far from over'

The City of Hamilton has been working for almost five months to restore and improve its online systems following a significant ransomware attack, but the work is “far from over,” says the city’s mayor.

During a Thursday afternoon news conference, Andrea Horwath said that on Feb. 25 the Southwestrn Ontaio city of 787,000 residents was “attacked by criminals and extensive damage was done.”

“And now, we're trying to recoup and we're trying to rebuild, and we're having some success,” she said.

On Wednesday, a Cybersecurity Incident Impact Update was presented at the city’s General Issues Committee, which provided information on what is being done to address the incident and the $5.7 million cost that has come with that. 

Horwath noted that this amount covers their efforts to recover and restore the city’s online systems as well as retain third-party experts.

“It's a heck of a lot of money, $5.77 million. I get that. Particularly at a time when we're all feeling the pinch, but the expenditures are necessary to help us safeguard our systems and make this even stronger against future threats,” she said.

“As we bring back systems, IT applications, and our services, the city has an opportunity to transform our technology and cybersecurity to better support residents and businesses and better protect us for years to come. And that ain't cheap either, I'm not going to sugarcoat it.”

Horwath added that she appreciates that this cyber security breach, which affected most of the city’s online systems and applications, has significantly impacted people in the community, residents, businesses, not to mention Hamiltton's 8,000-plus member workforce.

“I recognize the difficulties that this situation continues to create and the frustration that is caused. I want to assure Hamiltonians that I understand the inconvenience folks are dealing with and I sincerely thank everyone, again, for their continued patience and understanding,” she said.

“City staff are doing their very best to rebuild as quickly and responsibly as possible.”

Hamilton’s mayor said that while work is being done “around the clock” to remedy the situation, the rebuilt and the full recovery of the city’s online systems will take some time.

“Just imagine for a minute if your home was completely destroyed, and how long and how hard, costly and disruptive it will be to rebuild completely. Hamiltonians expect and deserve nothing less than the city leaving no stone unturned as we work hard to restore our systems,” said Horwath.

"The replacement and upgrade of select IT systems and other improvements will be done in the coming weeks and months. ... We're implementing the necessary upgrades that will better support residents and businesses. These upgrades will keep the city current and well positioned to provide a continuous level of high quality customer service."

Hamilton Mayor Andrea Horwath speaks during a June 20 news conference on the city's ongoing response to a Feb. 25 cyberattack.

City Manager Marnie Cluckie added that since the cyberattack was first identified their focus has been on “responding in a safe and secure manner as efficiently as possible.”

She said that soon after the onset, the city contained the incident and involved a team of experts and has worked steadily to rebuild and transform its systems with a customer-centric approach ever since.

“We've taken a strategic approach to restoration and are making decisions based on best meeting the needs of our citizens, our businesses and staff," said Cluckie, who noted that they’ve determined that there is “no evidence” that data or personal information was compromised.

“I also want to reiterate that the city did not pay the ransom,” she said, underlining that despite this setback Hamilton has delivered most of its core programs and services to the community with more coming back online “when it is safe and secure to do so.”

“Importantly, we have been able to restore many of the city's critical applications that serve the public with a priority placed on health and safety. Forty-five per cent have been restored to date,” Cluckie said.

Among other thigns, this includes general inquiry emails and Internet access. A temporary vendor payment solution has also been put in place in the interim, she added.

Cluckie said that a small number of the city’s IT 228 applications, roughly three per cent, are not recoverable. Mitigation strategies have been put in place to address that issue, she said.

The full restoration may not be done until at least a year from now, she said.

Hamilton police continue to investigate the incident.