Cyber Incident Victim: Town of Orangeville
Date:
Feb 2025
Location:
Canada
Summary
The Town of Orangeville detected a cybersecurity incident affecting its systems and promptly engaged experts to contain the breach while maintaining most municipal services. The attack disrupted online functions for Theatre Orangeville, the public library, and several departments including fire, finance, infrastructure, planning, and transportation, limiting services such as burn permits, library checkouts, billing, and permit applications. In‑person alternatives remain available for many transactions, and emergency services continue uninterrupted as the investigation proceeds.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 27, 2025, the Town of Orangeville became aware of a cybersecurity incident affecting its information technology systems and promptly initiated measures to safeguard data and limit further exposure. The town’s chief administrative officer, David Smith, stated that the incident is under investigation and that the municipality is working with cybersecurity experts and local authorities to determine the nature and full scope of the attack. He explained that the investigation is in its early stages and involves a thorough review and validation of potentially affected systems and data, noting that at that time it had not been determined whether any personal information had been compromised. Smith added that if the investigation finds that data was compromised, the town will notify the affected parties accordingly. He also mentioned that the town continues to prioritize system security and has added additional safeguards while collaborating with experts to enhance network security.
As a result of the incident, several municipal services experienced disruptions: Orangeville Fire is unable to process burn permits, sensitive receptor applications, or file search requests; the Orangeville Public Library cannot offer self‑serve checkouts, debit payments, printing, scanning, faxing, or Wi‑Fi access; customer service at Tony Rose is operating with limited capabilities. In the corporate sector, the clerks and bylaw department’s online commissioning of services, online burial permits, and online lottery donation proceeds are impacted, while the finance department cannot bill or retrieve water shut‑off information, provide copies of tax bills, access account information, or share parking fine balances. Infrastructure services show impacts to online building permits, email applications, online payments, and building inspection requests made by phone or via the website. The planning department cannot process online application submissions, online payments, online planning or building compliance request submissions, or online pre‑consultation meeting requests. Transportation services are affected insofar as online road occupancy permit applications and payments are disrupted. Despite these impacts, the town noted that most services continue with minimal to no effect and that only a few public services are experiencing temporary disruptions.
Many services remain available through alternative means: small business consultations are still offered in person, virtually, and over the phone; business program applications continue to be processed and business registration support is provided on site; visitor services have not been impacted. Orangeville Fire continues its regular emergency response, fire inspections, enforcement, and public education activities. Both branches of the Orangeville Public Library stay open for borrowing books and items, placing and picking up holds, processing inter‑library loan and book club requests, and providing on‑site computer use. Recreation facilities remain open, although in‑person debit payments are limited to programs at the Alder Recreation Centre. The clerks and bylaw department can still handle commissioning requests in person only, bylaw complaints via SeeClickFix or in person, snow‑clearing grants, and burial permits in person only. Licensing for temporary liquor licenses, mobile food vendors, restaurants, pet shops, vehicles for hire, and lotteries continues to be accepted. Fireworks permits, sign permits and variances, delegation requests, and freedom of information requests are not affected. In‑person debit, cash, or cheque payments remain possible for property taxes, building permits, commission, parking tickets, and account receivables; building permit applications can be submitted in hard copy with payments made in person, and building inspection requests can be made in person or by emailing [email protected]. For the planning department, submissions must be hard copy only, fee payments can be made by cash, cheque or debit, compliance requests must be hard copy, and pre‑consultation meeting requests must be hard copy only. Road occupancy permit applications and payments continue to be accepted via debit, cash or cheque, and transit service operates normally. The town’s press release emphasized that the matter is being handled with seriousness and diligence, that updates will be provided as more information becomes available, and that the commitment to protecting the privacy and security of the Orangeville community remains steadfast.