$2.9M Saint John cyberattack bill to be mostly covered by insurance
City refused to pay hackers demand for between $17 and $20M to release information
A cyberattack that held Saint John's network hostage and forced the city to rebuild its network from scratch will cost taxpayers $400,000 after insurance covers most of the $2.9 million bill.
The city was hacked on Nov. 13, 2020, halting everything from email and phone services, its website and paying for parking and building permits.
Hackers asked for bitcoin worth between $17 and $20 million to release the city's network, said Coun. David Merrithew at Tuesday night's council meeting.
Instead of paying, the city decided to rebuild its network and launch a new website. Merrithew said the cost of doing this and hiring a private firm to investigate the hacking cost about $2.9 million. Insurance will cover 85 per cent of that.
"The remaining 15 percent, $400,000, was put to very good use," Merrithew said. "We strengthened and upgraded our systems, probably a little ahead of what our calendar would have allowed us to do."
The money will come out of the city's IT reserves, city manager John Collin previously said, and won't cause any cuts to city services.
The new network is slated to be up by June. In the meantime, the city is running on a backup network.
2 insurance policies
A report submitted to council said the city has cyber and property insurance through AIG Canada. Both policies will help pay the bill since some hardware was affected by the attack.
The $2.9 million the city spent included:
- $1.1 million to Bulletproof Solutions for containment and recovery.
- $220,000 to FireEye Mandiant for forensic investigation.
- $52,000 to CYPFER for ransomware recovery and payment facilitation.