$2.9M Saint John cyberattack bill to be mostly covered by insurance

A cyberattack that held Saint John'snetwork hostage and forced the city to rebuild its network from scratch will costtaxpayers $400,000 after insurance covers most of the $2.9 million bill.

The city was hacked on Nov. 13, 2020, halting everything fromemail and phone services, its website and paying for parking and building permits.

Hackers asked for bitcoin worth between $17 and $20 million to release the city's network, said Coun. David Merrithew at Tuesday night's council meeting.

Instead of paying,the city decided to rebuild its network and launch a new website. Merrithew said the cost of doing this and hiring a private firm to investigate the hacking cost about $2.9 million. Insurance will cover 85 per cent of that.

"The remaining 15 percent, $400,000,was put to very good use," Merrithew said."We strengthened and upgraded our systems, probably a little ahead of what our calendarwould have allowed us to do."

The money will come out of the city's IT reserves, city manager John Collin previously said, and won't cause any cuts tocity services.

The new network is slated to be up by June. In the meantime, the city is running on a backup network.

2 insurance policies

A report submitted to council said the cityhas cyberand property insurance through AIGCanada. Both policies will help pay the billsince some hardware was affected by the attack.

The$2.9 million the city spent included:

• $1.1 million to Bulletproof Solutions for containment and recovery.
• $220,000 toFireEye Mandiant for forensic investigation.
• $52,000to CYPFER forransomware recovery and payment facilitation.