Ransomware disabled most of the City of Hamilton's network for weeks

The City of Hamilton, Ontario, a municipality of roughly 600,000 people southwest of Toronto, became aware on the evening of Sunday, February 25, 2024 that ransomware had struck its network. The attack disabled about 80 percent of the city's IT systems.

Core services including water and wastewater treatment, waste collection and transit kept running. Most other operations did not. Online payment systems were unavailable, so residents had to pay taxes, tickets and fines in person. Phone lines across dozens of city services went down, libraries lost Wi-Fi and public computers, and all city council meetings scheduled before March 15 were cancelled.

City Manager Marnie Cluckie said in early March that it was impossible to know how long it would take to get systems running again. Hamilton brought in outside cybersecurity experts, its insurers, legal counsel and law enforcement, confirmed that it carried cyber insurance, and said it was investigating whether resident data had been stolen. Officials declined to discuss any ransom negotiation, and no ransomware group had publicly claimed the attack at that stage.

The city later said the attackers demanded roughly $18.5 million and that it refused to pay. Global News reported in July 2025 that recovery had cost Hamilton about $18.3 million, and that its insurer denied the claim on the grounds that multi-factor authentication had not been fully implemented when the attack occurred.