The city of Laval, in turn, came under computer attack and was forced to interrupt some of its online services to citizens. Mayor Stéphane Boyer said a “limited” amount of information was stolen, but the municipality still doesn’t know what documents it matches.
Published at 15:08
Updated at 19:02.
The city’s computer services realized something was wrong around 4:00 pm on Wednesday. Therefore, in order to protect itself from hackers, the city has disabled access to some of its services via the Internet. “We are currently trying to prevent a computer attack,” Mayor Stéphane Boyer said at a press conference on Thursday. He explains that the attack took place through an employee’s email, which the attackers compromised.
The mayor says the city has “no reason to believe” that citizens’ personal information has been “read or stolen.”
In an interview with La Presse, his cabinet’s communications director Alexandre Banville wants to be reassuring. This ensures that the public’s sensitive information is not compromised. “We want to reassure citizens that nothing threatens their data. It’s not someone from some financial institution that pulled the database,” he says.
“It can be a lot of text”
“What was recovered is not something very heavy, but we do not yet know what it is. If these are photographs, then some of them have probably been stolen. But if this is a text, then there can be a lot of text, ”continues Alexander Banville.
In total, the city estimates that cybercriminals could have stolen 600 megabytes, or 600 million bytes.
This is equivalent to tens of photographs or tens of thousands of pages of text without images.
In the future, computer experts from the giant Microsoft will support the city in its efforts to delve deeper into its networks and make sure no other element has been compromised. At the end of the day, on Thursday, city services gradually responded to the checks. However, the main irritant remained: any form of payment to the municipal authorities was impossible.
Citizens also could not get acquainted with the municipal evaluation sheet.
On Twitter, the municipality asked citizens for “cooperation” “to avoid using online services to contact the city” until Sunday, September 18. Instead, authorities suggest using “personal or telephone services” during the weekend by visiting service desks or calling 311 directly.
“It is important for us to act fully transparently and quickly in context,” said Alexandre Banville.
Experts interviewed by La Presse also welcomed the mayor’s decision to quickly report the attack. “I think they chose the right strategy: they told people the exact situation,” said Karim Ghaname, cyber threat detection expert at Streamscan. Then the city will have to regularly inform the population, he believes.
“This is the right way to do it,” said Brett Callow, an analyst at antivirus firm Emsisoft. This is a public organization and the public should be informed about the situation. »
They agree that the event appears to be relatively minor, according to the details provided by Laval. “It looks like one mailbox has been hacked,” said Alexis Dorais-Joncas of cybersecurity firm Proofpoint. There may be some sensitive stuff in there, but the hackers didn’t seem to have access to the full emails. »
Computer attacks have increased in Quebec in recent months.
Also in Laval, a group of hackers attacked the Montmorency College and published tens of thousands of files on a hidden network (darknet), La Presse reported on September 8. In particular, they contain information about internal investigations of employees, as well as medical and psychiatric information. The leak also includes identifying information about hundreds of people, such as their social security number, date of birth, and full contact information.
Leisure vehicle maker BRP Valcourt also suffered a serious cyberattack in August. The hackers then leaked thousands of documents stolen from Ski-Doo, hundreds of which are trade secrets, into a hidden network.
57 billion dollars. Estimated losses due to corporate email compromise worldwide, 2016-2021
FBI Internet Crime Complaint Center