DIDSBURY - The Town of Didsbury did not pay anything to hackers who conducted a cyberattack on the municipality’s information system last month, says the town's mayor, Rhonda Hunter.
The mayor's comments come as town council approved $15,000 to enhance cyber security of its IT (information technology) services in 2021.
On March 21 fraudsters encrypted the town’s system with ransomware and made a ransom demand to decrypt the system.
Immediately following the attack, the mayor and Ethan Gorner, the town's chief administrative officer, declined to say whether a ransom was paid. That has now changed.
“We haven’t paid ransom and there’s been no contact for that group or person,” Hunter said. “We are willing to give that information now and we need to give out that information.”
Asked what amount the fraudsters were demanding, Gorner said, “The full ransom payment that was demanded was unclear. Fortunately, we have been able to restore the town's system from backups without having to respond to the extortion attempt and fund this criminal activity.”
Hunter says while no ransom was paid, upgrading the security system in response to the cyberattack will come with a cost.
“The downside is there are big costs to enhancing and increasing cyber security,” she said. “As we work to enhance and strengthen our system that is going to be a cost, but a necessary cost.
“We believe that once we do have that enhanced security, more protection is better of course.”
Gorner added, “The costs of securing the town against the increasing threat of cyberattacks are not finite. The town's efforts to improve security continue to evolve to meet the developing threat of cyberattacks against municipalities.”
During the April 27 council meeting, councillors approved the addition of $15,000 to fund changes in the level of service for IT services.
Administration is recommending the implementation of cyber security services, which includes a managed and monitored endpoint protection program, security information and event management software, and situational security awareness training for users, chief financial officer Amanda Riley told council.
The change in level of service will help better protect town data and help with business continuity, she said.
“It means someone is watching if or when there is a threat,” said Riley. “These systems will help to recognize and eliminate threats in real-time, so training the users in real-life situations is important.
“It’s found that the users of the system are typically the weakest link because you could easily click on a website with something planted on it, and then all of a sudden the threat has potentially entered the system.”
The $15,000 will be for the remainder of 2021 and includes a one-time set-up fee, she said.
“An annual cost is about $18,000 to $20,000 for an organization of our size,” she said.
Councillor Bill Windsor said he believes the town would be remiss if it didn’t change the service level to improve security.
“I agree and our recommendation is to move forward with this,” said Riley. “It wouldn’t reduce every threat to our system, but it definitely will help eliminate and reduce threats, which we know are ever-increasing.”
Councillors passed a motion to approve the level of service for IT and approve the addition of $15,000 to the 2021 operating budget for cyber security services.
Following council's vote, CAO Gorner said, "Cyber security is integral for protection of our data as well as for our business continuity. Threats to any network are increasingly common and more impactful than ever before.
"Threats are seen to impact organizations big, small and anywhere in between. There is no one single solution to security, rather, multiple layers of protection should be implemented."
