Their insurer refused every ransomware claim — MFA was started, not finished.

City of Hamilton report Read the original →

In February 2024, cybercriminals gained access to an external internet-facing system at the City of Hamilton, deployed ransomware, and demanded a ransom. The way in was not email — it was a system facing the internet.

The attack disabled roughly 80 per cent of the city’s network, and the attackers wanted to be paid for the way out.

“The attackers demanded a ransom of roughly $18.5 million in exchange for a decryption tool to unscramble the city’s data.”

Recovery was long and expensive. By June 30, 2025, the City had spent $18.3 million on immediate response, system recovery and third-party expert support. It held cyber insurance, and it filed a claim.

“The insurer cited policy exclusions related to multi-factor authentication (MFA), noting that MFA had not been fully implemented at the time of the cybersecurity incident.”

The requirement was not news. Staff knew about the multi-factor authentication condition in the City's insurance policy in the fall of 2022, and a pilot rollout began the following year — but only for a few departments. When the attack came, the rollout had not reached everyone, and the policy gave no coverage for losses where the absence of MFA was the root cause.

“There was insufficient assurance prior to the incident that the cyber insurance policy would be applied as anticipated by the City.”

After the denial, the accountability question moved to council — who knew, and when.

“The city had full knowledge we were not compliant with the exclusion in 2023”

A third-party legal review confirmed the denial, and the City did not pursue it further — though it has since renewed its coverage. Its acting chief information officer disputed the insurer's finding, telling reporters the breach would have happened even with MFA in place. The dispute changed nothing: the exclusion was applied, and none of the roughly $5 million in claims was paid.