Cyber Attack Cost the City $668,000

Wednesday, 11 December 2019 10:39

The City of Woodstock did not end up paying a ransom and the total cost of the cyber attack is $668,000.

WOODSTOCK - The Cyber Attack on the City of Woodstock is going to cost $668,000.

CAO David Creery explains where most of that money was spent.

"The majority of the cost relate to the cyber response team that was hired to come in and support the City through the forensic investigation, as well as the trust restoration of the rebuilding of our network."

Creery says they decided to not contact the attackers and they did not pay a ransom, because they could still access the information that was stolen.

"We did not make contact with the threat actors, we did not feel that it was necessary, we thought that reaching out to them, would be paying for something that we already have. Some of our systems may have been encrypted but we have tape backups that were not encrypted, so for us, paying for any kind of ransom, would be paying for data, that we actually have."

The City of Stratford had a similar attack and they did pay a ransom of $75,000. They also had cyber insurance and the City of Woodstock did not have cyber insurance. So in the Stratford case, the insurance company paid for the investigation and the recovery. Creery says, the City considered the option of paying a ransom, but ultimately decided it was not the best route for them to go.

"There is probably going to be questions about why we didn't pay the ransom, it would have been cheaper. The answer is quite simple, why would we pay for something that we already have. The counter argument will be, that you could have got your systems back up and running sooner if you had paid and there is truth in that, it hides the bigger problem, if you have your systems back, you don't know if the hacker has removed all of his access points. We would have ended up doing exactly what we did, no matter what, whether we paid or didn't pay. We still would have gone through, scanned, imaged, cleaned and rebuilt each server piece by piece and so really, for us, when we compare the decision point of do you pay and get your stuff back sooner, or do you use your data backups and rebuild, it was a very simple decision for us. We use our data backups and we rebuild, because that is essentially what we are going to do, even if we pay."

The system is back up and fully functional now. Everybody has access to the network, however a few things are still being worked on, internal facing things, such as, scanning access to email. The system has been completely rebuilt from the ground up.

Creery says This will not impact the tax levy and the money will come from reserves.

"This was not, obviously a budgeted item, so the recommendation is to finance the cost of this recovery from various reserves."

Staff have recommended using $232,619 from the Modernization Grant, $54,810 from the Reserve for Salaries and Benefits and the balance from the Hydro Reserve Fund.