"A" for Accountability-Is the City of Hamilton Truly Owning the Cybersecurity Failure?

In a recent piece by Scott Radley of The Hamilton Spectator (see it here) ), Mr. Radley rightly questions whether the City of Hamilton is truly “owning” its failures related to the February 2024 cybersecurity breach. He asks: what does “owning it” really mean in this context? We agree with his assessment. The City’s response thus far does not reflect true accountability.

On July 30, The Hamiltonian formally requested the following from the City:

A copy of the cyber insurance policy in effect at the time of the attack, along with the specific terms the insurer relied on in denying the claim. We asked: “Why was the claim denied, and what specific terms were not satisfied? How were those terms breached?”

We have since received the City’s response, which is provided in full below. But before presenting it, we offer these observations.

According to the City, the insurance claim was denied because multi-factor authentication (MFA)—a critical security measure—had not been fully deployed across all departments. This was a clear requirement of the insurance policy.

The City admits that this requirement was not met. Therefore, the insurer’s denial appears justified.

Let’s be frank: If a homeowner failed to install smoke detectors—despite it being a condition of their insurance—and their house burned down, the insurance company would rightly deny the claim. The loss would be devastating.

This situation is no different—except the scale of loss is exponentially larger. Millions in taxpayer dollars have been lost due to what can only be described as operational negligence. Where is the accountability?

Has anyone been fired for this critical oversight? If not, what exactly does the City mean when it speaks of “accountability”? Can public employees expose taxpayers to such significant financial consequences without consequence? What message does that send to staff, if they perceive there are no repercussions?

What message does that send to Hamilton residents, and what precedent does it set?

The City cannot undo what has already occurred. But it can show leadership now. Will any staff be removed for failing to implement basic cybersecurity protocols? 

Hamiltonians deserve clear answers—and real accountability. Stay tuned...The Hamiltonian will be following up.


City of Hamilton Response (August 7, 2025):

“This was a highly sophisticated attack on an external, internet-facing server, gaining unauthorized access to the City of Hamilton systems. At the time of the February 2024 cyber attack, multi-factor authentication (MFA) was not fully deployed in every City department. The insurance policy in effect at the time stipulated that MFA had to be fully deployed across the organization.

If you would like a copy of the City’s cyber insurance policy in effect at the time of the cyber incident, a request through the Freedom of Information process would be necessary as this document is a contractual agreement with a third party. For more details related to Freedom of Information requests and to submit a request, please follow the link here.

The City is committed to the principles of openness, transparency and accountability in line with the protocols of the City’s Freedom of Information Office.”


\