DATABREACHES [.]Net analyses the Canadian municipal cybersecurity landscape, highlighting how a ransomware attack on City of Hamilton on 25 February 2024 crippled roughly 80% of its network and spurred an $18.3 million CAD spend on response, recovery and upgrades after the attackers demanded an $18.5 million ransom, which the city refused to pay.
According to Nonprofit Tech Support, the city’s cyber insurer denied a $5 million claim because MFA had not been fully implemented across all required systems, leaving the city technically out of compliance and taxpayers bearing the recovery bill. The piece also summarises verified impact metrics for other municipalities: Saint John faced a demand of between $17–$20 million in bitcoin in 2020 with about $2.9 million in recovery costs and roughly 85% insurance coverage, while St.
Marys paid a ransom of around C$290,000 in Bitcoin in 2022 and total expenses reached at least $1.3 million. Wasaga Beach, in 2018, suffered seven weeks of outages and paid about 3 bitcoin, with total incident costs around $252,000 CAD. The analysis emphasises that small municipalities can incur outsized losses, and that universal security controls and robust backups are essential.