Nova Scotia

CryptoWall virus hits some Mahone Bay and Bridgewater town computers

Some municipal computers in Mahone Bay and Bridgewater have been infected by a computer virus that originated in Russia and encrypted non-essential town files.

CryptoWall 3.0 and CryptoLocker viruses are sent through email or through hacked websites

Mahone Bay CAO Jim Wentzell confirmed the virus that originated in Russia, known as CryptoWall 3.0, infected document files four weeks ago.

Some municipal computers in Mahone Bay and Bridgewater have been infected by computer viruses that originated in Russia and encrypted non-essential town files. 

Mahone Bay CAO Jim Wentzell confirmed the virus, known as CryptoWall 3.0, infected document files four weeks ago. He says the infected documents date back to 2007. 

"The virus came in an email that said, 'Resumé,'" Wentzell said.

"And where we were looking to hire somebody, [the employee] just thought, 'Oh, there's another resumé to look at.' But it was a .zip file, and as it got opened, that was it. Bang." 

Wentzell says the virus targeted a specific directory containing correspondence files, but was stopped at the letter F as it attacked the directory alphabetically. 

Bridgewater's CAO Ken Smith also confirmed their computers had been infected by CryptoWall 3.0, and a second virus called CryptoLocker.

IT Specialist Chris Meister, who provides technical support for both towns, says the viruses attack non-networked directories through email or by a hacked website.

In Mahone Bay's case, the virus delivered an automated message requesting payment in return for unlocking the infected files. 

"With the CryptoWall 3.0, it's basically almost impossible to be decrypted unless you pay your ransom," Meister said.

For this reason, these kinds of viruses are often called ransomware.

The ransom was three bitcoins — around $900 — but Meister explained the money wasn't paid because it's a scam.

"It's becoming a lot more common of a virus than what most people realize," he said.

'It could have been a heck of a lot worse'

Wentzell says the files that were infected will not impact customers or citizens in any way.

"Our accounting system has its own separate drive altogether, has its own protection. Any customer records were not affected. Any accounting records were not affected," he said.

The infection hit, Wentzell said, two days before a major budgetary meeting.

"It could have been a heck of a lot worse," he said. 

Meister says he's now installed preventative measures: a real-time, offline backup of all files, as well as preventative software that targets these types of viruses. 

"What we do is, on our data servers, we put on an application called CryptoPrevent, and what that does is prevents any files from being encrypted," he said.

"There's no way you can 100 per cent protect yourself because they think up another way of doing it. And by the time the anti-virus companies have picked up on it, it's already out there." 


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Account Holder

Join the conversation  Create account

Already have an account?