What do cities face when hit by a ransomware attack? Cyber experts explain, as Hamilton issue continues

Behind closed doors at Hamilton's city hall, staff are in emergency mode, scrambling to respond to a ransomware attack that's disabled dozens of services for over a week. 

Few details have been released about the attack on Hamilton's computer systems. The situation is ongoing and therefore "sensitive," both the mayor and city manager have previously told reporters. 

But CBC Hamilton spoke to four experts who said the impacts are likely extensive.

"What we're observing in Hamilton is serious," said McMaster University Prof. Andrea Zeffiro, an expert in critical data studies. 

Although the city's emergency and water services have been spared, many other systems residents rely on like accessing WiFi at the public library, paying for services online or with debit or credit cards and calling programs and staff are not possible for the second week in a row. Some city workers, such as bus drivers, have had to go without computerized aids. Council committee meetings have been paused.

There's also no timeline for when services will be restored. 

Ransomware is a type of malicious software that "denies a user's access to a system or data until a sum of money is paid," according to the Canadian Centre for Cyber Security. 

Ransomware attacks are likely the most disruptive form of cyber crime and have the power to render entire systems useless, destroy vast amounts of data and be costly, complicated and lengthy to recover from, according to agency's national report for 2024. 

While the experts CBC Hamilton interviewed this week don't know the behind-the-scenes details about the Hamilton attack, they shared insights based on other municipalities' experiences.

"The ways attacks are carried out are constantly changing," Zeffiro said.

"These groups are adapting their tactics in response to security measures and even organizations with really good data security are susceptible."

What experts do know is attacks are often coordinated by criminal organizations with links to Western adversaries like Russia, North Korea, Iran and China, said Kush Sharma, a director at Municipal Information Systems Association (MISA) Ontario. 

The attackers look for targets where they can shut down services or steal personal information so they have ample leverage when they demand payment.

"Municipalities in Canada are actually housing some of the most critical infrastructure in the country — water systems, transportation, solid waste, elections, emergency services," Sharma said.