Canadian city says timeline for recovery from ransomware attack ‘unknown’

The city of Hamilton, Canada, is still recovering from a ransomware attack that has affected nearly every facet of government functions.

City officials have worked around the clock since the ransomware attack was discovered on February 25. As of Wednesday, foundational services like water and wastewater treatment, waste collection and transit are operational.

But nearly every system used for online payments has been affected by the attack, forcing the city to turn to cash transactions and other manual methods. Any tax payments, tickets or fines have to be paid in person.

The city listed out dozens of government services — from cemeteries to child-care services and the city’s libraries — that were dealing with website issues or phone system problems.

All city council meetings before March 15 have been canceled and none of the city’s libraries are offering WiFi, public computers, printing services and more.

“The City of Hamilton took swift action to investigate, protect systems and minimize impact on the community. We engaged a team of experts, insurers, legal counsel, and relevant authorities and [are] working diligently to restore the City’s system in a safe and secure manner,” the city said in a statement on Wednesday.

“While a timeline for recovery is not yet known, the City is committed to resolving the situation as quickly and effectively as possible.”

Hamilton is about 40 miles away from Toronto and has nearly 600,000 residents. The city said it is in the process of investigating whether resident information was stolen.

No ransomware gang has taken credit for the attack yet and city officials did not respond to requests for comment.

City officials held a press conference on Tuesday, where City Manager Marnie Cluckie said it is “impossible to know how long it will take us to get up and running again.”

“We’re pleased that we can still offer most of our City services,” she said. “It hasn’t been easy, and we really appreciate that residents are being patient. We apologize for the inconvenience this is causing.”

Cluckie declined to answer questions about whether the city is negotiating with the ransomware gang but said they will “do what is best for the city.” She confirmed the city has cyber insurance.

During the press conference, Cluckie was pressed on whether the attack would have a similar timeline to that of the Toronto Library, which spent more than four months dealing with issues following a ransomware attack. Cluckie said the cyber experts hired would only tell her that each attack and recovery is different.

Hamilton is the second municipality in Canada to deal with a ransomware attack over the last week after Ponoka — a small town about an hour away from Edmonton — also dealt with a ransomware attack that caused system outages for government payment systems.

The attack was claimed by the Cloak ransomware gang on Sunday.