Hackers Demand Ransom In Saint John Cyberattack

City officials in Saint John have not ruled out paying the ransom demanded in a significant cyberattack against the municipality.

Mayor Don Darling and City Manager John Collin held a news conference Tuesday to provide more details about the attack.

Darling told reporters they first learned about the attack late Friday when routine monitoring discovered “unusual activity.”

“IT staff determined it was a ransomware virus,” said Darling. “The city immediately took steps to minimize the impact and protect our systems, notified police and engaged a firm that specializes in cybersecurity.”

Ransomware is a type of malicious software that infects your device and holds your files and data for ransom, according to the Canadian Centre for Cyber Security. The cybercriminals will demand payment in the form of untraceable digital currency, such as bitcoin.

It is described as “one of the most common forms of cybercrime” which targets individuals and companies, big and small.

‘All Options’ On The Table

Collin said they have not yet decided whether to pay the ransom but declined to comment on the specific amount, saying it is “not of any value or interest.”

“All options to restore our networks are still on the table,” said Collin. “There are far too many aspects to consider and criteria to look at before we would make any determination on consideration of ransom.”

City officials also refused to say how effective the attack was, which systems are affected and how containment efforts are going, saying it would be “beneficial to the attacker as they could attempt further attacks.”

All of the city’s IT systems remain offline following the attack, including its website, online payment systems, email and customer service applications.

But Collin said critical city functions and most routine services are still operational, including transit, water and wastewater treatment, emergency services, and the 911 communications centre.

“Many departments have adapted quickly to continue with regular business and are processing information manually,” he said. “This process will continue to develop as needed in the days ahead.”

The city is currently not able to enforce parking or accept payments for any services it provides, such as water bills and parking tickets. Customers will not be charged late fees while the systems are down.

It is also unable to issue building permits at this time but Collin said they hope to have a manual process up and running soon.

IT Systems Could Be Down For Weeks

At this point, Collin said there is no indication that any personal information has been accessed by the attackers, but he did not rule it out.

“Determining this is a priority for us,” he said. “When we know more, we will notify the community immediately.”

Residents are encouraged to keep an eye on their bank accounts and credit cards for any suspicious activity.

There is also no indication when the city’s IT systems will be back up and running, but Collin said they are looking at “weeks, not days.”

Darling said the city is working with police and security advisors, along with federal and provincial resources to resolve the situation.

“I’d like to acknowledge the work of this highly dedicated and knowledgable team who will see us through this situation through to recovery,” said Darling.

Collin said the city plans to release a “lessons learned” package so others can learn from what they have gone through.