Hamilton taxpayers are looking at fronting the full cost of a devastating 2024 cyberattack after the city’s insurance company denied its claim.

Councillors were told at the general issues committee meeting on Wednesday that the city’s claim was denied because multi-factor authentication had not been fully implemented at the time of the attack.

According to the city’s insurance policy, no coverage was available for any losses where the absence of multi-factor authentication was the root cause of the cyber breach.

“I understand why Hamiltonians are frustrated — this was a serious and costly breach,” Mayor Andrea Horwath said in a news release Wednesday.

“We expect our public systems to be strong, secure, and dependable. This incident highlights that the city fell short of that standard — and we’re not okay with that.”

On Feb. 25, 2024, Hamilton experienced a cyberattack that disabled roughly 80 per cent of its network and impacted services like business licence processing, property tax, transit planning and finance and procurement systems for weeks.

A few systems were unrecoverable, the city said, including permit applications and licensing, fire department records management and traffic signal system management.

1:14
‘Too early’ to assess impact of cybersecurity breach, City of Hamilton says

The attackers launched a complex ransomware attack through an external internet-facing server, the city said. After covertly studying the city’s systems, they encrypted systems and data to render them unusable and attempted — but failed — to destroy all the city’s backups.

The attackers demanded a ransom of roughly $18.5 million in exchange for a decryption tool to unscramble the city’s data. The city did not pay the ransom, adding it contained the incident within two days and managed to provide critical services throughout.

Get breaking National news

For news impacting Canada and around the world, sign up for breaking news alerts delivered directly to you when they happen.

“Paying the ransom would have increased the City’s risk and financial exposure,” the city said in the news release, saying technical advisers added decryption tools from cybercriminals are very often unreliable.

“Even with a working tool, safe restoration would have taken significant time and money. Additionally, paying ransom funds could fuel future cybercrime and support international organized crime and terrorist organizations.”

Mike Zegarac, general manager of finance and corporate services, told councillors on Wednesday the city would have to incur costs regardless of whether it had paid the ransom.

To date, the city has spent $18.3 million on immediate response, system recovery and third-party expert support. There may be additional invoices still to be received for some items that will be included in future reports, staff noted.

Of the $18.3 million, $14 million has been spent on external experts who have helped the city’s response, redesign and future strategies, staff added.

2:18
Ontario health agency ordered to inform patients of major data breach

At the general issues committee meeting Wednesday, Ward 2 Coun. Cameron Kroetsch took issue with the “looseness” of Hamilton’s cyber strategy.

“There weren’t protocols in place for many parts of the city, including how we connected to devices … and there was virtually no training provided whatsoever to councillors with respect to what to do here,” he said.

“This didn’t happen due to councillors’ negligence of any kind, or councils for that matter. But there have been several reports I’ve monitored outside of being an elected official where I saw recommendations being made to address this, and the investments not being made to pick up with those for whatever reason … we knew we had these problems with place … this has to be taken more seriously.”

Ward 9 Coun. Brad Clark said he found it “very frustrating” that multi-factor authentication wasn’t put in place years ago after learning from a staff member at the meeting that Hamilton’s insurance company sought it in late 2022.

When its claim was denied, the city obtained a third-party review of the decision and did not pursue further legal action as it learned the insurer’s action was based on coverage terms.

“The city had full knowledge we were not compliant with the exclusion in 2023,” he said.

“How does council find out it wasn’t done if staff doesn’t share it with us? I find it immensely frustrating there has been zero accountability on this; this chamber, we’ll be held accountable in a year and a bit; front bench and all the staff, no accountability for this incident. I can’t explain that to my residents.”

The city has since said it has enhanced its cyber controls and renewed its insurance coverage.

In her statement, Horwath said Hamilton will learn from the incident.

“We acted swiftly, and we’re moving forward with focus and determination. This is also a clear and indisputable reminder that timely investments in public infrastructure help prevent far more costly reactive responses down the line,” she said.

“The City of Hamilton is rebuilding with resilience and future-proofing in mind, while strengthening our systems, improving protections, and ensuring better service and safeguards for our entire community.”

&copy 2025 Global News, a division of Corus Entertainment Inc.

Toronto has moved to ban motorized watercraft from one of its busiest beaches by next year due to concerns over unsafe operators and illegal rentals, but one rental company says the city should instead focus on regulations that weed out “bad actors” in the industry.

City council passed a motion last week requesting that PortsToronto ban boats and personal watercrafts such as Jet Skis within at least 150 metres of the shoreline at Woodbine Beach in the city’s east end by June 2026.

The motion also condemns “illegal” rental business practices at the beach and nearby Ashbridges Bay, such as using and storing watercraft without proper boating permits and operating them unsafely.

“I’m relieved that this was passed because job No. 1 of local government is to keep our residents safe,” said Coun. Brad Bradford, who introduced the motion and represents Ward 19 Beaches — East York.

Bradford said the ban request was spurred by concerns over unlicensed rental companies that operate and park their watercraft along the beach, and “reckless” drivers that put swimmers, kayakers and paddleboarders at risk.

“They’re a menace to the community,” Bradford said. “It’s a matter of time before somebody gets injured or killed.”

Earlier this summer, a motorized watercraft exclusion zone was introduced at Hanlan’s Point Beach on Centre Island, extending 200 metres off the shore as part of a pilot project for this year’s boating season. Some residents of Etobicoke in the city’s west end have also started petitions calling for a similar exclusion ban in Humber Bay.

Earlier this month, Toronto police carried out an enforcement blitz targeting illegal watercraft rentals and unsafe boating practices in the city, issuing more than 50 tickets for provincial offences and dozens of bylaw charges.

“These guys come out, pay the fine, and just go right back out into their operations and they’re making so much money on it,” said Bradford.

Get breaking National news

For news impacting Canada and around the world, sign up for breaking news alerts delivered directly to you when they happen.

Police said in an emailed statement that they respond to as many as 10 complaints per day related to unsafe watercraft rentals, including riders steering too close to shorelines and entering designated swim zones.

Toronto police say another “huge concern” is that many personal watercraft operators don’t have proof of competency, as required by Transport Canada. For people renting a boat or a Jet Ski, that means running through protocols and signing a safety checklist with the rental company.

Those operating Jet Skis and similar watercraft within Toronto’s harbour from Humber Bay to Ashbridge’s Bay also require a permit from PortsToronto known as a “powered vessel operator’s permit,” said Mike Riehl, the authority’s director of harbour operations.

But some watercraft rental companies say despite following all the rules, they are being lumped in with a few “bad actors” that are ruining operations for the rest through unsafe business practices. They are urging city council to reconsider the latest ban along Toronto’s shores.

Raj Mehta, one of the founders of rental company Jetti, said that while he supports cracking down on unsafe and irresponsible operators, watercraft bans at city beaches also penalize businesses like his that operate safely.

“We’re at the ramp and on the water almost every day and we witness the safety issues the city is bringing up,” he said. “There are some operators that should not be operating.”

Jetti sends its watercraft out of Humber Bay West, an area outside of PortsToronto’s jurisdiction, he said.

Mehta said his company follows safety regulations by having insurance, GPS-based speed controls on Jet Skis to respect no wake zones, and issues proof of competency through rental boat safety checklists.

“We use the public dock but we don’t actually leave any watercraft in the water … when they come back, we pull them onto trailers and they’re out of here,” he said, adding that many other operators leave their watercraft along the shore.

“Anyone can go buy a few Jet Skis and call themselves a rental company and start renting these out because there is no regulation,” he said. “These are the guys causing the safety issues, these are the people that are not respecting public space.”

Mehta said he is willing to work with the city to figure out a solution that would focus on regulation, such as setting up designated launches for personal watercraft away from public beaches and boat launch areas, or leasing space from the city.

Despite reaching out to a local councillor and the mayor’s office, Mehta said he has not received responses to his proposals and requests.

Companies looking to work with the city can reach out and make proposals but “none of that’s happened,” Bradford said, adding that an amendment to his motion to create a stakeholder advisory committee could include rental companies.

While Bradford recognizes the entire industry isn’t breaking operational and safety rules, based on his observations at Woodbine Beach he believes rental companies aren’t interested in working with the city. He said they could look into leasing boat slips across the waterfront if they want to continue their operations.

Mehta said his company has already explored renting space from marinas but there are a “whole bunch of issues” with that option as marinas in the inner harbour fall under PortsToronto’s jurisdiction, which requires boaters to have specific permits that would be difficult to obtain for short-term renters.

“Jet Ski usage tends to negatively impact boaters and the boating experience in the harbour, so marinas are unlikely to want to cater to Jet Ski companies,” said Riehl from PortsToronto, adding that no marina in its jurisdiction rents space to such operators.

Mehta said he still hopes the city can figure out a solution that prioritizes safe and fair access to the waterfront and doesn’t push away those who are trying to follow the rules.

“We just want to get some attention to this because I think it’s kind of reached a boiling point and everyone wants something done,” Mehta said.

“A lot of our customers are local and a lot of them are also tourists, so there’s a lot of impact if this industry is shut down.”