Cybersecurity Incident: Recovery & Transformation

A Message to Our Community

On February 25, 2024, the City of Hamilton was the target of a deliberate and aggressive cybersecurity attack. A well-organized group of cybercriminals broke into City systems, caused significant disruption to City services and operations, and demanded a ransom of $18.5 million CAD.

The City worked quickly with cybersecurity experts and law enforcement to respond to the attack. Since then, we’ve continued to investigate and rebuild. 

We are now able to provide a full update to our community. We do so in the spirit of transparency and accountability, which remains a core value of the City. A series of detailed reports are available outlining the nature of the attack, its financial impact, and our efforts to rebuild and modernize City systems. These reports include:

• CM25007 – Building Better: Post-Cyber Project Portfolio Update
  A plan for stronger systems, better customer and staff experiences, and more efficient services.

• CM25008 – Cybersecurity Incident Summary
  New details about how the attack happened and the ransom demand.

• CM24005(b) – Cybersecurity Incident Costing Update
  A financial update on the $18.3 million spent so far and how we are managing the costs.

• CM25009 – Cybersecurity Resiliency Enhancements
  A summary of the new security improvements already in place to protect against future threats.

Personal or Health Information was not compromised
We know residents are concerned about the safety of their personal information. Based on third party review, we can confirm no personal or health information was stolen. 

Ransom was not paid
In line with advice from cybersecurity experts and law enforcement, the City of Hamilton did not pay the $18.5 million ransom.

Instead, we recovered our data using secure and well-maintained system backups. This approach:

• Aligns with industry best practices
• Reflects our commitment to responsible use of public funds
• Helps discourage the cycle of cybercrime by not financially rewarding criminal behaviour

Decryptors offered by attackers are notoriously unreliable, with only a 50 to 60% success rate. Paying the ransom would not have guaranteed recovery.

Ongoing Police investigation
The investigation into this cyberattack remains open and is being led by the Hamilton Police Service, with support from provincial and federal agencies. Because this is an active criminal investigation, sensitive technical and forensic details are being carefully considered before public release.

For any media inquiries about the investigation, please contact Hamilton Police Service directly.

Costs and recovery efforts 
Responding to and recovering from this incident has cost the City approximately $18.3 million through June 2025. To manage these costs responsibly, a three-year funding plan has been introduced as part of the 2025 Tax Budget. This plan uses existing project funding and prioritizes resources to reduce the long-term impacts on taxpayers.

Building Better: A more resilient future
This incident has tested the City’s resilience, but it has also become a turning point for progress. We are using this experience to build stronger, more secure systems and modernize how we serve our community.

Through the City’s Build Better initiative, we are:

• Strengthening IT infrastructure
• Enhancing cybersecurity protocols
• Modernizing outdated systems 
• Improving service delivery across departments

This work is already underway and will continue through 2025 and beyond.

Thank you, Hamilton
We sincerely thank Hamiltonians for your patience and support throughout this challenging time. We know this disruption affected residents, businesses, and community partners.

We also want to thank City staff for their hard work in keeping essential services running and helping with recovery. Your efforts have helped Hamilton come back stronger.

Resources

Key reports and updates related to the incident: