The city of Saint John, New Brunswick has to pay millions in cybersecurity costs following the ransomware incident it experienced last year – and AIG Canada will be covering part of it.
On November 13, 2020, routine monitoring discovered that Saint John’s systems were affected by ransomware. Services such as email, phone, and online payments for parking and building permits were disabled, and the city’s website was shut down.
The hackers responsible for the attack had asked for ransom payments between $17 million and $20 million in bitcoin, to release the city’s systems from encryption. But instead of giving in to the hackers’ demands, the city chose to rebuild its network from scratch, and launch a new website.
Councillor David Merrithew told CBC News that the city’s total cost to restart everything from scratch, plus hiring a private firm to investigate the hacking, cost about $2.9 million, with insurance covering about 85% of the expenses.
A breakdown of the costs included:
“The remaining 15%, $400,000, was put to very good use,” the councillor said. “We strengthened and upgraded our systems, probably a little ahead of what our calendar would have allowed us to do.”
City manager John Collin previously explained that the remaining costs would come out of the city’s IT reserves, and would not cause any cuts to other city services.
A report submitted to the council revealed that Saint John has cyber and property insurance via AIG Canada. Both insurance policies will cover the attack, as several pieces of hardware were affected by the incident.
