Hamilton Cyberattack Costs Reach $5.7 Million and Growing

The City of Hamilton has revealed that it has spent $5.7 million recovering from a major ransomware attack that paralyzed its systems in February. The cyberattack affected 228 unique IT applications, including those supporting the city's phone lines, transit operations, permit applications, and public health inspections. It has significantly impacted the city's infrastructure and operations. City officials warn that a full recovery costs years.

The ransomware attack, discovered on February 25, caused widespread disruption across Hamilton's municipal systems. In the aftermath, the city brought in external experts Hamilton's millions on new infrastructure, such as servers and cellphones, and worked tirelessly to restore services. As of May 28, less than half of the affected applications—45 percent—have been restored, with priority given to critical services. Among those restored are 60 percent of the applications deemed "critical."

The city chose not to pay the ransom demanded by the hackers and has "instead opted "d to rebuild its systems. While officials have refused to disclose the ransom amount, they remain committed to focusing on recovery and long-term resilience. The preliminary costs incurred so far total $5,714,926, which covers external experts, infrastructure, and staffing required for the recovery process. The lion's share of the expenses, nearly $3 million, was spent on external experts to help with the breach and recovery services. Additional funds were spent on new infrastructure, including printers and storage servers, to restore essential services during the chaos that followed the attack.

While these costs have been absorbed into the 2024 budget, the city expects to spend an additional $33.6 million between 2025 and 2033 to strengthen its cybersecurity infrastructure, modernize services, and mitigate future risks. To minimize the impact on taxpayers, the city may draw funds from pre-approved technology projects or reserves or delay certain capital projects.

In its first public written report on the cyberattack, Hamilton officials outlined the ongoing challenges in restoring and rebuilding the city's IT infrastructure. While nearly half of the impacted applications have been cited, a separate list of "unrecoverable" applications, including those related to licensing, permit applications, fire department records management, and the traffic signal system, has been posted online. In these cases, city departments have resorted to using manual processes as a temporary solution.

City Manager Marnie Cluckie acknowledged the complexity of the recovery process, emphasizing that this is a long-term effort focused on restoring what was lost and rebuilding more robust systems. "This is a large-scale effort to build back stronger than ever," Cluckie stated, "using the need for a user-focused approach, resilience, and p" protection against future cyber threats. She also highlighted that the city's recovery efforts come at a significant cost, and officials are exploring allcity'sns to provide taxpayers with the best value while addressing immediate needs and future services.

Deloitte, one of the external firms brought in to assist with the recovery, prepared a presentation for Hamilton's general issues committee highlighting the ongoing recovery and futuHamilton'sal impacts. The report acknowledges that the city's full recovery will take years, not months. The city's response to the attack is to identify and replace applications that the city has reached their end-of-life cycle with future reports to calculate the costs, timelines, and outcomes of these replacements.

Despite the scale of the attack, forensic experts have found no evidence that personal data or information was compromised. While city officials remain tight-lipped about the exact details of the breach due to security concerns, they have confirmed that a cyber-insurance policy is in place. However, whether it is still determined that insurance will cover any preliminary costs listed in the report is unclear.

As the city continues its recovery and transformation efforts, it has implemented new cybersecurity measures to protect against future incidents. A press conference is scheduled to update the public further on the city's progress and the long-term plan for restoring and improving its services.