Cyber Incident Victim: City of Montmagne
Date:
Jan 2021
Location:
Canada
Summary
The City of Montmagne suffered a ransomware attack that resulted in a complete shutdown of its computer and telephone systems. While municipal phone services were restored after six days, most computer system access remained blocked, severely disrupting operations for an extended period.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The City of Montmagne experienced a disruptive cyber incident beginning on or around January 15, 2021, which escalated into a full-scale ransomware attack between January 16 and 17. This attack forced the complete shutdown of the city’s computer networks and telephone systems, crippling municipal operations. Initial reports indicated widespread inaccessibility to critical digital infrastructure, with employees unable to perform routine administrative functions or communicate internally via standard channels. The attack persisted for nearly a week, with most computer systems remaining locked and unusable as of January 15 or 16, based on the timeline described in public updates. Municipal services reliant on digital platforms faced significant interruptions, though specific departments or functions affected were not detailed in available reports.
Response efforts focused on restoring basic communications first, with the Town Hall telephone system successfully reactivated six days after the initial attack—around January 21 or 22. This partial recovery allowed limited external coordination, though core computer systems remained largely inoperable beyond that point. No public statements confirmed whether ransom demands were made, paid, or negotiated, nor did officials identify the specific ransomware variant or threat actors involved. The prolonged outage disrupted routine civic operations for over a week, though the full scope of data compromise or financial impact was not disclosed. Restoration timelines for non-telephonic systems remained unclear at the time of reporting, with recovery efforts ongoing as of the latest available updates.