Report pegs Saint John cyberattack recovery costs at $2.95 million so far

Recovery costs related to a cyberattack against the City of Saint John are close to $3 million, according to a new report to the city’s finance committee.

Saint John was forced to shut down its IT network following the attack on Nov. 13, 2020. Many online services were shut down including the city’s website. Parking enforcement was halted temporarily and building permits could not be issued.

The report said the ransomware attack was “wide-reaching with significant damage caused to the City’s IT infrastructure.”

City Manager John Collin said previously that it appeared no sensitive or personal information had been compromised, but the city decided to rebuild its network.

The total projected costs for consulting services, network hardware, licences, support and other network needs are estimated at just over $2.95 million.

The report said up to 85 per cent of that — about $2.5 million — should be covered under two cyber insurance policies through its insurer, AIG, although the actual amount covered won’t be known until the company “provides their written position following the city’s submission of proof of loss.”

The remaining amount is expected to be split between the city’s operating budget and reserve funds. More costs are expected.

Councillor David Merrithew, the chair of the city’s finance committee, said it’s important for residents to know that Saint John will not be borrowing any money to pay for the recovery effort.

He praised work of staff in getting many of the systems back online quickly.

Merrithew said the city has tightened its security protocol as recovery continues.

“We’ve managed to have the city back to all the necessary workings are happening,” Merrithew said. “So, we can pay our water bills and we can get building permits.”

City officials have not revealed the ransom demand, but say they did not pay any ransom.

2:06 Several attempts have been made to infect information systems in Fredericton