District of Squamish experiences virus attack on IT systems

On February 27, the District of Squamish’s information technology (IT) systems experienced a virus attack. District staff worked quickly to isolate and eradicate it, resulting in many systems being shut down as a precaution, including email. This was a ransomware attack where the user files are encrypted and held for ransom. The District has not paid any ransom money, and most systems are back up and running with minimal data loss.

These types of viruses focus on encrypting data; not on stealing data or personal information. There is no evidence to indicate that the personal information of citizens or employees was compromised. The District’s website Squamish.ca was not impacted, though the recreation booking engine Squamishlive was taken offline. Efforts are being made to bring the system back online prior to Wednesday when spring program registration is scheduled to open. 

“Like so many government organizations we have become a target for well-funded criminal groups that are insistent upon creating havoc, and we are very thankful that no personal information appears to have been compromised,” says District of Squamish Mayor Karen Elliott. “Due to the expertise of our staff, the District quickly moved over to manual operations in key areas, ensuring that citizens saw little evidence of the interruption.”

Over the past several months, the District has taken steps to improve network security and build up network threat protection following a similar attack in 2019. Many of the changes implemented, such as additional firewalls, more robust spam protection, greater frequency of backups and overall network security upgrades to name a few, helped to minimize the impact of this one. The District is now fast-tracking a move to cloud-based server hosting with virus protection and backups built in. A new IT role focusing on network security is also being funded in the 2020 budget. 

“The security of District systems continues to evolve to minimize losses and ensure protection of data against these very sophisticated attacks, which are an unfortunate reality that we may always be faced with,” continues Elliott.

An in-depth forensic analysis is being undertaken to understand how the attack was perpetrated to improve resilience against future attacks.

March 3, 2020