City of Hamilton says it refused to pay ransom to criminals behind cyberattack

The City of Hamilton is adamant that it has not paid a ransom to the criminals responsible for an ongoing ransomware attack against the city.

The breach that knocked out several online services was initially discovered on Feb. 25 and has since been confirmed by the city as a ransomware attack.

Mayor Andrea Horwath could not disclose the exact amount of money requested, but says it was a “whole hell of a lot of money.”

“We can’t be very specific because we don’t want to be putting the city in a position where the bad actors that we’re dealing with… get information that would then put us at further risk,” Horwath said during a press conference Friday.

“It was a huge ask.”

City officials also reiterated that residents’ personal information has not been compromised.

“All evidence at this point, and based on what our cyber experts are telling us, is that while it’s encrypted it hasn’t been removed from the organization, it hasn’t been taken and therefore it hasn’t been compromised,” said City Manager Marnie Cluckie.

The city says it continues to recover from the attack, with the focus now turning to rebuilding IT systems.

“We’ve successfully contained the breach and now rebuilding and restoring our IT systems is where we’re at,” Horwath said.

READ MORE: City of Hamilton shifting to ‘recovery and rebuilding’ in cyberattack response

Officials also provided an update for city workers, saying a delay in overtime pay will be rectified at the beginning of the next pay cycle later this month.

Some workers, such as paramedics, had not received overtime pay because the city says it wasn’t able to access systems needed to provide the pay due to the ransomware attack.

Hamilton Police Deputy Chief Ryan Diodati confirmed the force launched a criminal investigation into the matter on Mar. 1.

“These are sophisticated criminals,” Diodati said.

“These types of investigations are quite complex. We continue to gather the evidence and we will continue to follow that evidence.”

The city says there’s no information on where the cybercriminals are working from, and there is still no indication of how long it will take for Hamilton City Hall to get back to normal.