Ransomware hits Black & McDonald, contractor to Canada's military

Black & McDonald, a Toronto-based engineering and facilities management firm with contracts across Canadian military bases, power plants and transit systems, was hit by ransomware in early 2023. Canada's Department of National Defence said it was informed of the incident on February 10, 2023.

The company is the parent of Canadian Base Operators, which holds facilities management and logistical support contracts with the Defence Department through Defence Construction Canada. The Globe and Mail valued one 2020 award at $157 million over ten years.

Defence Construction Canada blocked all incoming email from Black & McDonald as a precaution and conducted business by phone or in person until the company restored its systems. A Defence spokesperson said there was no evidence of any effect on Defence Construction Canada systems or files, or on Defence Department and Canadian Armed Forces operations or security, noting that for most contracts of this type the contractor has no direct access to departmental networks or sites.

Black & McDonald declined to comment publicly on the attack. No ransomware group had claimed responsibility as of early March 2023, and the incident remained under investigation. The company reports more than $1.5 billion in annual sales and employs about 5,500 people across 35 North American offices.