City hopes to have more priority systems, like Hamilton fire dispatch, recovered by next week

Hamilton’s city manager says teams assigned to “recover and rebuild” databases following the recent cyberattack hope to have some priority systems, like fire dispatch, back online sometime next week.

Four weeks after a ransomware attack crippled the municipality’s online operations, Marnie Cluckie says third parties “cleaning and sanitizing” data are making progress and could potentially have “computer-aided dispatch systems” working again in days.

“It’s anticipated for some time next week,” Cluckie said in an update on Friday.”The public may not see that directly, but those are some of the things that are happening in the background right now.”

The addition of a team from Deloitte’s cyber-security division this week bolstered crisis management, communications and project management as the city’s efforts begin moving away from “forensic analysis” and into rebuilding city hall’s systems.

“As we shift into the rebuild stage, we need some additional skill sets to strengthen the team,” Cluckie explained. “We need more people because we want to make sure that we’re getting services and systems back online safely and securely, but as quickly as possible as well.”

Cluckie revealed regular day-to-day IT teams are aiding third parties during the process and says a “breach coach,” brought on by the city’s insurer, has been guiding information being shared with the public in the first couple days after the discovery of the breach.

“I would characterize it more like they’re guiding and giving us the advice that we need, and making sure that we understand the impact of certain decisions,” she said.

The late Febraury cyberattack affected a wide range of municipal services including phone lines, Wi-Fi, transit apps and electronic payments.

Last week, Hamilton mayor Andrea Horwath revealed attackers demanded a “whole hell of a lot of money” from the city, which is not being paid.

She also confirmed recovering systems impacted “won’t be cheap.”

Cluckie hopes to publicly reveal information about those costs near the end of securing and bringing systems back online.

“Right now, we’ve been focused on making sure we’re bringing those services online and that we’re keeping the system safe,” Cluckie said. “But we are compiling those costs, and of course, we want to be transparent and share that with the public as we progress.”