Media briefing from the City of Saint John in relation to the Ransomware Virus

Transcript of media briefing with Mayor Don Darling and City Manager John Collin

Mayor Darling
We thank you for joining us today, and to your help in communicating key information from the City to the community. 

As you are aware through our previous communication, the City has been affected by a significant computer virus. 

In response to this situation, our overall objective has been to contain the exposure, control our response and mitigate risk.

The virus was discovered late Friday, when routine monitoring uncovered unusual activity. 

• IT staff determined it was a ransomware virus.

• Given the live investigation, the City will not comment on the ransom demand.

The City immediately took steps to minimize the impact, and protect systems:

• Notified police, and engaged a firm that specializes in cyber security.

• The Government of New Brunswick was also notified.

• Coordination with these partners has been ongoing, around the clock.

• Team of experts immediately began investigating to determine what systems were impacted and took steps to isolate the breach and protect networks, such as disabling the City’s website, our servers, email, etc.

• The City’s Emergency Operations Centre has been activated to help coordinate any issues that may arise.

The City has engaged with police and is working with security advisors to resolve the situation in a safe and secure manner. We also have full coordination with federal and provincial resources. I’d like to acknowledge the work of this highly dedicated and knowledgeable team, who will see us through this situation through to recovery. 

City Manager

Critical City functions are operational, such as Transit, water, and wastewater treatment and emergency services. The provincial 9-1-1 call and dispatch services are functioning.

Most routine services are also operational, including access to the City’s recreational facilities, the Saint John City Market, solid waste management, public works, P.R.O. Kids, and our Customer Service Counter. 

Many departments have adapted quickly to continue with regular business and are processing information manually. This process will continue to develop as needed in the days ahead. 

The City is not able to process online payments at this time. Customers who are able to pay through their bank, should do so. Late fees will not be charged to those who need to make new payments at this time while our systems are down.

The City is unable to issue building permits at this time. A manual process is being developed to have this service back up and running soon. We are working to minimize all impacts to the delivery of our services. 

At this time, we do not have any indication that personal information was accessed or transferred. Determining this is a priority for us. When we know more, we will notify the community immediately. 

For now, and out of an abundance of caution, and as we advised on Sunday, it is generally a good idea to check your personal accounts and credit cards for any irregularities and to notify your financial institution if you see anything odd or suspicious. 

There is no timeline yet for restoration of our IT services, but it is safe to say that we are looking at weeks, not days. Everyone is working as quickly as possible to get the City’s system up and running in a safe and secure manner.

The City has been asked by some to share confidential details about the attack. While ensuring that the public remains informed, and any impact on the delivery of municipal services is understood, our community must also acknowledge that providing too much information would be problematic to recovery efforts. We do not want to publicly provide details that could further compromise the City’s position, including information on the effectiveness of the attack, the systems affected, and success of our containment efforts. Providing this level of detail would be beneficial to the attacker as they could attempt further attacks.  

It would also provide valuable information to potential copycat hackers and could compromise investigative efforts.  

We already know that many hackers and scammers have taken a heightened interest in Saint John because of the advertised attack on City assets. We would suggest that all members of our community exercise extreme caution when dealing with unknown individuals or businesses on the phone or on their personal Internet services.

It is important for the community to know that we have leading experts working with our teams around the clock at this time. The investigation is ongoing, and we are assessing the situation in real time and will continue to provide updates when information is available. 

In due course, we will produce a lessons learned package so others can learn from our experience.  

Mayor Darling

In closing, the City is working diligently to restore all systems as soon as possible but in the interim, the City continues to provide quality services to its residents, businesses and guests.

We thank our residents for their patience during this time. We will keep them updated regularly through our social media accounts and the media.