New Brunswick

$2.9M Saint John cyberattack bill to be mostly covered by insurance

A cyberattack that held Saint John's network hostage and forced the city to rebuild its network from scratch will cost taxpayers $400,000 after insurance covers most of the $2.9-million bill.

City refused to pay hackers demand for between $17 and $20M to release information

Saint John was hit with a ransomware attack on Nov. 13, 2020. (PabloLagarto/Shutterstock)

A cyberattack that held Saint John's network hostage and forced the city to rebuild its network from scratch will cost taxpayers $400,000 after insurance covers most of the $2.9 million bill.

The city was hacked on Nov. 13, 2020, halting everything from email and phone services, its website and paying for parking and building permits. 

Hackers asked for bitcoin worth between $17 and $20 million to release the city's network, said Coun. David Merrithew at Tuesday night's council meeting.

Instead of paying, the city decided to rebuild its network and launch a new website. Merrithew said the cost of doing this and hiring a private firm to investigate the hacking cost about $2.9 million. Insurance will cover 85 per cent of that.

"The remaining 15 percent, $400,000, was put to very good use," Merrithew said. "We strengthened and upgraded our systems, probably a little ahead of what our calendar would have allowed us to do."

The money will come out of the city's IT reserves, city manager John Collin previously said, and won't cause any cuts to city services.

The new network is slated to be up by June. In the meantime, the city is running on a backup network.

2 insurance policies

A report submitted to council said the city has cyber and property insurance through AIG Canada. Both policies will help pay the bill since some hardware was affected by the attack.

The $2.9 million the city spent included:

  • $1.1 million to Bulletproof Solutions for containment and recovery.
  • $220,000 to FireEye Mandiant for forensic investigation.
  • $52,000 to CYPFER for ransomware recovery and payment facilitation.

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Member

Join the conversationCreate account

Already have an account?

now