Cybersecurity Update General Notification

The City identified and quickly contained a cyber incident on February 25, 2024. The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals. However, the cybercriminals used ransomware, and the City’s IT systems were encrypted. Some personal information and personal health information remain unrecoverable because of this encryption.

The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals.

If you are a Public Health Services (PHS) client, any information about you entered into PHS’ primary medical records system between August 24, 2022, and February 24, 2024, is unrecoverable. This may include details such as age, gender, address, lab reports, health history, and health services provided.

In addition, there are select City systems that are unrecoverable due to the cyber incident, including systems that support permitting and licensing, administration of land development applications and approvals, financial and business management, museum collections management, Fire Services records management, utility locates processing, and rent supplement and tracking. As a result, personal information contained within these systems will also not be recovered.

The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals. The cybercriminals used ransomware, and the City’s IT systems were encrypted. Some personal information and personal health information remain unrecoverable because of this encryption.

The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals.

If you are a Public Health Services (PHS) client, any information about you entered into PHS’ primary medical records system between August 24, 2022, and February 24, 2024, is unrecoverable. This may include details such as age, gender, address, lab reports, health history, and health services provided.

There are select City systems that are unrecoverable due to the cyber incident, including systems that support permitting and licensing, administration of land development applications and approvals, financial and business management, museum collections management, Fire Services records management, utility locates processing, and rent supplement and tracking. As a result, personal information contained within these systems will also not be recovered.

The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals. If you are a Public Health Services client or City services user, no action is currently required.

If you are a PHS client or City services user, no action is currently required. Should there be any further information about the cyber incident, personal health information or personal information, we will provide updates on the City’s dedicated cyber incident website, available at www.hamilton.ca/cyberincident.

The City has notified the Information and Privacy Commissioner of Ontario (IPC) of the incident. Individuals have the right to file a complaint with the IPC about their personal information or personal health information through the following website www.ipc.on.ca/en/resources/information-individuals. While individuals are welcome to file a complaint with the IPC, it is not necessary, as the IPC is already investigating.

Public Health Services Contacts
Key contacts for public inquiries related to Public Health Services are:

City Customer Contact Centre: For general information and assistance related to the cyber incident, please contact the City’s Customer Contact Centre at 905-546-2489 (CITY) or email [email protected].

Note: PHS and the City will not contact you by email, text, or phone requesting that you provide or confirm any personal health information or personal information.

There are select City systems that are unrecoverable due to the cyber incident, including systems that support permitting and licensing, administration of land development applications and approvals, financial and business management, museum collections management, Fire Services records management, utility locates processing, and rent supplement and tracking.

Essentially all City services are now operating in a full or modified state. Public Health Services (PHS) has restored all health records outside of the time period of August 22, 2022 and February 24, 2024 and has resumed documenting care in the primary medical records system.

Guided by external cybersecurity experts, the City has enhanced and will continue to enhance its existing cyber-security controls. More broadly, the City has taken multiple steps, working with a team of experts in the investigation, response, restoration, and rebuilding efforts for its affected IT systems. With essentially all services now operating in a full or modified state, the City is taking a customer-centric approach that considers both immediate needs and the future state of the City's services.

The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals. If you are a PHS client or City services user, no action is currently required.

The City is committed to building back stronger than ever, which means leading with a focus on the user experience and approaching everything through a lens of resilience. The City has been focusing on identifying opportunities to improve and strengthen systems and infrastructure, and to protect against future cyber incidents. This includes assessing each application to determine whether it should be brought back to its pre-incident state, upgraded, or replaced to accelerate a transition to the City’s desired future state.

A Hamilton Public Health Services (PHS) client is a person or persons who receive(s) a health care service provided by Hamilton Public Health Services. Impacted services include: 

Public Health services that used the affected primary medical records system included:

Public health services that did not use the affected primary medical records system include Dental Health, Environmental Health and Hazards, Food and Water Safety, and Visual Health.

Public Health Services uses its primary medical records system to document the various services it provides to its clients.

Public Health Services (PHS) has brought back the impacted primary medical records system and continues to serve clients in a safe and secure manner. If you are a Public Health Services (PHS) client, please be advised that any information about you entered into PHS’ primary medical records system between August 24, 2022, and February 24, 2024, is unrecoverable.

Key contacts for public inquiries related to Public Health Services are: