Town of Hinton

Summary

A municipal government experienced a cybersecurity incident that began with network connectivity issues and was later determined to involve a possible unauthorized third-party access to its IT systems. In response, the municipality took its systems offline to contain exposure and engaged IT and cybersecurity experts to investigate. As of the most recent update, no evidence had been found that any sensitive government or citizen information was misused. Service disruptions persisted during the restoration process, including the inability to process credit or debit payments at town facilities, delays in applying some payments to customer accounts, and the shift of swimming lesson registration to online-only. Alternative payment methods such as e-transfer, cash, cheque, and OptionPay remained available, and no late penalties were being applied for affected accounts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 13, 2025, the Town of Hinton began experiencing network connectivity issues that affected its information technology infrastructure. Town staff immediately began investigating and working to resolve the problem, bringing in IT and cybersecurity experts to assist with the response. Initial communications from the Town described the situation as network connectivity issues, and at that point the cause had not yet been identified. As the technical investigation progressed, those experts determined that the connectivity problems were the result of a cybersecurity incident rather than a routine technical failure or outage.

Preliminary findings from the investigation indicated that an unauthorized third party may have gained access to the Town's IT systems. The exact entry point, the duration of access, and the precise scope of the potential unauthorized activity were not immediately confirmed. The Town stated publicly that, at that stage, it could not confirm the extent of any potential unauthorized access to its systems. The acknowledgment that an external actor may have been involved marked a shift from the initial characterization of the event as a connectivity problem to a formal recognition of a cyber incident affecting municipal systems.

In response to the discovery, the Town took its IT systems offline out of an abundance of caution. This step was intended to contain the exposure, prevent further unauthorized activity, and minimize any potential damage to systems or data. Taking systems offline had a direct effect on Town operations and on the services available to residents. While the systems were down, the Town's operations and communications were limited. Staff worked alongside cybersecurity experts to investigate the incident, monitor the situation, and begin planning the secure restoration of services.

As of the February 25, 2025 update, the Town reported that there was no evidence that any sensitive Town or citizen information had been misused in any way. Investigators were actively monitoring for signs of data misuse and examining the systems to determine what, if anything, had been accessed. The Town committed to providing all necessary notices should the situation change and the investigation later revealed evidence of data access or misuse. Officials also indicated that they would follow all applicable privacy laws as the response continued.

The Town also issued guidance to residents during the incident, encouraging citizens to take added precaution and to be on alert for any suspicious activity. This included being cautious of unsolicited requests for personal or sensitive information, whether those requests appeared to come from the Town or from other third parties. The advisory reflected the uncertainty that remained about whether any personal data had been exposed and was a precautionary measure to help residents protect themselves while the investigation continued.

By the March 6, 2025 update, the Town reported that it was still working to securely restore its networks and return services to full functionality. At that point, IT and cybersecurity experts continued to investigate the incident, and to date had found no evidence that any sensitive Town or citizen information had been misused. The restoration process was described as diligent and ongoing, with systems being brought back online only after appropriate security verification.

The ongoing restoration had several specific operational impacts on Town services. Town buildings, including the Dr. Duncan Murray Recreation Centre, were unable to accept credit or debit payments while the affected systems remained unavailable. Some payments made to the Town during the period of disruption might not yet have been applied to customer accounts. To prevent penalizing residents during this time, the Town confirmed that penalties would not be incurred on accounts where payments had been made on time. To help residents continue making payments, the Town noted that e-transfer, cash, cheque, and OptionPay remained accessible as alternative payment methods. Additionally, upcoming swimming lesson registration was being made available online only.

Throughout the response, the Town emphasized that it was working closely with cybersecurity experts to manage the incident in a diligent and responsible manner and to mitigate any potential impacts. The Town stated that it considers the security and privacy of its IT systems and the information they hold to be of the utmost importance. Officials committed to continuing to share relevant information as it became available and to following all applicable privacy laws as the investigation and restoration progressed.

Sources

Sources available to members: 1 source.