Expert says odds are against municipalities amid ‘significant cyber attack’ on City of Saint John

As a result of a ‘significant cyber attack’ on the City of Saint John, all its information technology (IT) systems have been shut down. That includes the city website, online payment systems, email and customer service applications.

The city posted the news to social media Sunday evening.

“We do not yet know whether personal information stored on our networks has been compromised,” the statement said.

People are being urged to monitor debit and credit statements for suspicious activity.

Two years ago, the city’s parking payment system was breached.

David Shipley, a cybersecurity expert and CEO of Beauceron Security, says he suspects a Russian organization is behind the attack. A lot of supporting resources, such as federal and provincial tech experts, will be keeping an eye on the investigation.

“So you don’t do that casually… You do it when you know you’re well-financed, and usually from a jurisdiction that you’re untouchable from,” Shipley tells Global News.

“In this case, my leading suspect would be an organized criminal group operating out of Russia.”

Shipley says it took “weeks to contain and rebuild” when the City of Woodstock (Ont.) was the victim of a cyber attack in 2019, and that it could be a similar timeline and a costly effort for Saint John. It would be an “amazing accomplishment” to have it resolved with services fully restored within “months.”

He applauds the city for shutting down all its IT services.

“Now they’re going to re-establish trust in all these resources,” he says. “That’s going to take time, resources and expertise… It’s going to be painful.”

If the attack is as significant as the need to shut everything down, and if it’s a sophisticated threat actor, “it’s a lot of damage.”

4:24 Cyber Security Awareness

People are being urged to monitor their debit and credit statements for any suspicious activity.

But overall, odds are stacked against municipalities due to limited resources and small IT teams, he says.

“Our IT teams and our security teams have to be right 100 per cent of the time… A criminal just needs to get right once.”

Pointing out the fact that banks spend hundreds of millions of dollars on security annually, Shipley notes that municipal and provincial jurisdictions “don’t have unlimited money to spend on these problems.”

Saint John Deputy Mayor Shirley McAlary says councillors will be updated in a private meeting Monday.

She’s asking for people to be patient, despite the inconveniences

“It is concerning to all of us,” she says. “We don’t realize how much we depend on technology.”

The city posted another update Monday evening, suggesting some information won’t be shared because it “would be beneficial to the attacker as they could attempt further attacks.”

Saint Johners who spoke with Global News Monday shared their thoughts on the investigation.

“I find it quite frightening,” says Turi Fast. “Personal information is very important to keep private.”

“It’s sad, but it’s not a surprise because you know it’s happened around the world,” says Gerry Dort. “I mean Revenue Canada’s been infiltrated, and elections have been infiltrated, and lord knows personal accounts.”

“Stuff like that is becoming more and more common as time goes on,” says Randy Krumprie. “Everything is becoming more techno, more online, more computerized, so the more information that’s put on, I guess the easier it is for everything to go.”

The city says since water bills and parking tickets can’t be paid right now, no late fees will be applied.