Cyber Incident Victim: City of Hamilton
Date:
Apr 2018
Location:
Canada
Summary
A data breach impacting two waste collection applications, Recycle Coach and My Waste, compromised approximately 1,100 residents' email addresses. The incident stemmed from a security failure at Municipal Media Inc., the third-party provider responsible for these services, which notified Hamilton and other affected municipalities. The compromised information was limited to email addresses, with no indication of broader personal or financial data exposure. The city acknowledged the breach and relied on the vendor's disclosure, though specific technical details regarding the breach's origin or duration were not publicly disclosed by either party.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The City of Hamilton disclosed a data breach affecting approximately 1,100 residents' email addresses in April 2018. The incident stemmed from unauthorized access to two municipal waste collection applications, Recycle Coach and My Waste, operated by third-party service provider Municipal Media Inc. The provider notified Hamilton and multiple other municipalities about the breach during the week preceding April 21, 2018. No specific intrusion timeline, attack vector, or perpetrator details were publicly confirmed by the city or its vendor. The compromised data was limited to email addresses, with no evidence of exposure for passwords, financial information, or other sensitive resident data. Municipal Media Inc. assumed responsibility for incident reporting while coordinating with affected local governments.
The breach impacted only users who had voluntarily provided email addresses for service notifications through the waste management apps. City officials emphasized that core municipal IT systems remained unaffected, as the incident was confined to the third-party applications. Public disclosure occurred after Municipal Media Inc.’s verification of compromised records, though forensic investigation specifics were not released. No reports emerged regarding misuse of exposed emails, such as phishing campaigns or spam surges targeting affected residents. The incident highlighted supply chain risks for municipalities relying on external vendors for digital services, though no subsequent operational disruptions to Hamilton’s waste collection services were documented.