Hamilton says it didn't pay ransom to cyberattackers — but won't say how much was demanded

Hamilton's mayor says the city didn't pay the hackers behind a ransomware attack that has disrupted municipal services for weeks — but she and other city officials wouldn't share other details, like how much money was demanded and exactly how much data Hamilton is locked out of.

"The demand was a whole hell of a lot of money, I can tell you that," Mayor Andrea Horwath told reporters during a Friday news conference, emphasizing that she values transparency and is sharing what she can.

"We don't want to be putting the city in a position where the bad actors we're dealing with ... get information that would put us at further risk. I know that frustrates people, but that is the reality."

During the Friday news conference, she and City Manager Marnie Cluckie said the city is restoring and rebuilding its systems, but couldn't say how long it will take for things to be back to normal and how much it will cost taxpayers.

Because the hackers locked or encrypted the data, the city's efforts will include building new systems and using backup data to restore services.

"It will take some time," Horwath said. "This is pretty hardcore stuff."

The city has assured residents numerous times it has no reason to believe anyone's privacy has been affected because there's no sign the hackers have taken any of the data it locked up.

That said, the city has notified the province's privacy commissioner of the incident.

Privacy experts previously told CBC Hamilton they are skeptical that no one's data was breached.

Lingering impacts of the cyberattack

The cyber attack in late February shut down almost all city phone lines, paralyzed city council and impacted dozens of services including the bus schedule app, library WiFi and permit applications.

Other issues have included firefighters having to use Google Maps to respond to calls, city workers not getting overtime pay, city staff being unable to access some reports, delays in processing approximately $36 million in pre-authorized property tax payments, and delays in paying vendors, among other things.

It's unclear where or who the hackers are. The city has insurance coverage for cybersecurity breaches, but didn't share details of the policy on Friday.

Cluckie said Hamilton is still on high alert using "enhanced monitoring tools" to protect itself.

She also said the city has been working with police, the province and cybersecurity experts at Cypfer.

Hamilton Police Dep. Chief Ryan Diodati said on Friday police have contacted partners from around the world as it investigates the incident. 

Asked about what the city could've done to prevent the attack, Horwath said she doesn't think there was "one particular thing" that allowed for the attack but the city will identify any weaknesses and make municipal systems stronger.

But some issues are being addressed.

Cluckie said city workers should get their overtime pay by next pay cycle and WiFi is working in most public libraries.

"We're taking it one step at a time to make sure each [system] is recovered safely and securely."