Hamilton to 'restore services progressively over time' after cyberattack: city manager

Hamilton has shifted its response from responding to the ransomware attack that has disrupted city services for more than two weeks to "recovery, restoration and rebuilding," according to city manager Marnie Cluckie.

"I'll liken it to a castle under attack. You have to first lift the drawbridge up to protect everybody inside and then you start to look at how you will address things," Cluckie said in a Wednesday afternoon interview with CBC Radio's Here and Now.

"We have managed to safeguard and now we are looking at all the systems we have."

It is unclear how long the recovery will take but in an emailed statement to CBC from Cluckie on Thursday, she said the city will "restore services progressively over time. Some services will come back sooner than others."

The city appreciates residents' patience, she added.

"Regrettably, these incidents take a lot of time to recover from."

Cluckie said she is not able to share details of the city's response to the attack at this time, including whether the ransom was paid, because any information shared publicly "may also be information that is shared with the criminals," she wrote.

"They, including potential copycats, want more information so they can do a better job of attacking us or any other public organization."

On Feb. 25, the ransomware attack shut down almost all city phone lines, paralyzed city council and impacted dozens of services including the bus schedule app, library WiFi and permit applications.

It's unclear how much money the hackers wanted or where or who they are, but the city has insurance coverage for cybersecurity breaches, Cluckie previously said.

She had said the city had contacted police and the province and was working with cybersecurity experts at Cypfer to resolve the issue.

Workers will get OT pay soon, no personal data breached: manager

The cyber attack also led to city workers not receiving overtime pay and questions about if anyone's personal information was breached.

In the radio interview on Wednesday, Cluckie addressed both concerns.

She said the city is working on getting overtime pay to workers soon but hasn't had attendance systems working, so people are manually filling out time sheets.

She also said despite what some experts have suggested, the city has "no evidence" to suggest anyone's personal information was accessed.

"We know the data was encrypted by the ransomware, but there's no evidence that information has ... gone outside," Cluckie said.

"The city has contained the systems and all of our evidence points to that personal information having not been accessed."

Cluckie said if any personal information was breached, it will be reported and the public will be informed.

She said Hamilton will "learn" from this experience.

"As we rebuild, we're making sure we're putting all the necessary measures in place to build that resiliency and to help ensure this doesn't happen again," Cluckie said.

"That will take time ... but we know we will come out stronger."