Breach Notification
Cybersecurity Update General Notification
Date modified
Cybersecurity Incident Update
We would like to update you about the cybersecurity incident that the City of Hamilton identified on February 25, 2024, and quickly contained.
The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that cybercriminals compromised individuals’ personal information or personal health information. However, the cybercriminals used ransomware, and the City’s IT systems were encrypted. Because of this encryption, some personal information and personal health information remain unrecoverable.
How You Might be Affected
If you are a Public Health Services (PHS) client, please be advised that any information about you entered into PHS’ primary medical records system between August 24, 2022, and February 24, 2024, is unrecoverable. This may include details such as age, gender, address, lab reports, health history, and health services provided.
In addition, select City systems are unrecoverable due to the cyber incident, including systems that support permitting and licensing, administration of land development applications and approvals, financial and business management, museum collections management, Fire Services records management, utility locates processing, and rent supplement and tracking. As a result, personal information contained within these systems will also not be recovered.
What the City is Doing
The City has taken multiple steps, working with a team of experts in the investigation, response, restoration, and rebuilding efforts for its affected IT systems. With almost all services now operating in a full or modified state, the City is taking a customer-centric approach that considers both immediate needs and the future state of the City's services.
PHS has brought back the impacted primary medical records system and continues to serve clients in a safe and secure manner.
For More Information
If you are a PHS client or City services user, no action is currently required.
Should there be any further information about the cyber incident, personal health information or personal information, we will provide updates on the City’s dedicated cyber incident website, available at www.hamilton.ca/cyberincident
PHS and the City will not contact you by email, text, or phone requesting that you provide or confirm any personal health information or personal information.
The City has notified the Information and Privacy Commissioner of Ontario (IPC) of the incident. Individuals have the right to file a complaint with the IPC about their personal information or personal health information through the following website www.ipc.on.ca/en/resources/information-individuals. While individuals are welcome to file a complaint, it is not required, as the IPC is already investigating.
For further information related to this notification, please review the frequently asked questions and specific PHS contact points. For general information and assistance related to the cyber incident, please contact the City’s Customer Contact Centre at 905-546-2489 (CITY) or email [email protected].
General Notification FAQ
The City identified and quickly contained a cyber incident on February 25, 2024. The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals. However, the cybercriminals used ransomware, and the City’s IT systems were encrypted. Some personal information and personal health information remain unrecoverable because of this encryption.
The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals.
If you are a Public Health Services (PHS) client, any information about you entered into PHS’ primary medical records system between August 24, 2022, and February 24, 2024, is unrecoverable. This may include details such as age, gender, address, lab reports, health history, and health services provided.
In addition, there are select City systems that are unrecoverable due to the cyber incident, including systems that support permitting and licensing, administration of land development applications and approvals, financial and business management, museum collections management, Fire Services records management, utility locates processing, and rent supplement and tracking. As a result, personal information contained within these systems will also not be recovered.
The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals. The cybercriminals used ransomware, and the City’s IT systems were encrypted. Some personal information and personal health information remain unrecoverable because of this encryption.
The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals.
If you are a Public Health Services (PHS) client, any information about you entered into PHS’ primary medical records system between August 24, 2022, and February 24, 2024, is unrecoverable. This may include details such as age, gender, address, lab reports, health history, and health services provided.
There are select City systems that are unrecoverable due to the cyber incident, including systems that support permitting and licensing, administration of land development applications and approvals, financial and business management, museum collections management, Fire Services records management, utility locates processing, and rent supplement and tracking. As a result, personal information contained within these systems will also not be recovered.
The City and its third-party cybersecurity experts have thoroughly investigated, and there is no evidence that individuals’ personal information or personal health information have been compromised by the cybercriminals. If you are a Public Health Services client or City services user, no action is currently required.
If you are a PHS client or City services user, no action is currently required. Should there be any further information about the cyber incident, personal health information or personal information, we will provide updates on the City’s dedicated cyber incident website, available at www.hamilton.ca/cyberincident.
The City has notified the Information and Privacy Commissioner of Ontario (IPC) of the incident. Individuals have the right to file a complaint with the IPC about their personal information or personal health information through the following website www.ipc.on.ca/en/resources/information-individuals. While individuals are welcome to file a complaint with the IPC, it is not necessary, as the IPC is already investigating.
Public Health Services Contacts: For Public Health inquiries email [email protected]
City Customer Contact Centre: For general information and assistance related to the cyber incident, please contact the City’s Customer Contact Centre at 905-546-2489 (CITY) or email [email protected].
Note: PHS and the City will not contact you by email, text, or phone requesting that you provide or confirm any personal health information or personal information.