Cyberattack has cost Hamilton $7.4M so far, says city

The City of Hamilton has spent more than $7.4 million so far to repair its information technology systems after a crippling ransomware attack in February, the city's general manager of finance and corporate services said on Friday.

Mike Zegarac told a council meeting that the monies spent so far include nearly $5 million to external experts including Deloitte.

The new dollar figure, which reflects expenses up to July 24, is up from the $5.7 million spent on the recovery efforts as of May 28, when Zegarac delivered the previous update.

The city also said it has caught up on its backlog of vendor payments with Deloitte's help after its vendor payment system was affected by the hack.

The updated expenditures, which total an estimated $7,402,622, break down like this:

• $4,875,538 on external experts.
• $1,151,917 on infrastructure.
• $1,085,685 on staffing. 
• $289,482 on "other related costs."

No further information was provided on what the "other" costs entail.

In a report presented to council, Zegarac wrote that all goods and services paid for by the city's Emergency Operations Centre, of which he is the director, have followed city procedures, including its procurement policy. He said spending continues on the recovery effort.

"The city's focus has moved from immediate Response to the Recovery, Restore, and Rebuild / Transform Phases," he wrote.

"Building back stronger is being done with a focus on the customer and employee experience, enterprise solutions, efficiency and increasing resilience to protect against future incidents."

The ransomware attack shut down almost all city phone lines, paralyzed city council and impacted dozens of services including the bus schedule app, library WiFi and permit applications. The city maintains that there was no indication personal information was stolen. 

The city decided not to pay the ransom and to rebuild its systems instead. It hasn't revealed how much the hackers were demanding.