Municipalities and ransomware: a recurring target

On a Monday morning, in a municipality of a few thousand residents, the screens at town hall show a ransom demand. Payroll, tax accounts, permits and the phone system are down. The IT team is two people, sometimes a single supplier. There is nothing exceptional about this scenario: local public bodies keep coming back in the official assessments, for reasons that have more to do with the adversary than with the size of the target.

What the sources say

In its National Cyber Threat Assessment 2023-2024, the Canadian Centre for Cyber Security notes an increase in threat activity against municipal and provincial governments: it reports "over 100 cases of cyber threat activity targeting Canadian municipalities since the beginning of 2020". Most cases involved social engineering, unauthorized network access or the deployment of malicious code, such as ransomware.

The 2025-2026 edition puts ransomware first: it is the top cybercrime threat facing Canada's critical infrastructure, and Canadian incidents known to the Centre have grown, on average, 26% year over year since 2021.

The Ransomware Threat Outlook 2025 to 2027 describes, without naming them, two cases in the Canadian public sector. In the first, services were unavailable for months; the actors had remained dormant in the network for months before exfiltrating personal, medical and financial information, and the entity chose to rebuild its systems rather than pay. In the second, the organization recovered most of its services within days from its backups, without paying; certain systems still remained unusable for months, with costs estimated in the millions of dollars.

What the adversary wants

Money. The Centre assesses that ransomware actors operating against Canadian targets are "almost certainly opportunistic and financially motivated". Three levers explain why a local body suits them.

• Service disruption. According to the 2025-2026 assessment, critical infrastructure is an attractive target because these entities are perceived as more willing to pay large ransoms to prevent disruptions to critical operations. A body that cannot suspend its services faces the same calculation.
• Residents' data. According to the Ransomware playbook (ITSM.00.099), the actor encrypts the data, deletes connected backups and often steals the organization's data, then threatens to leak it. The 2023-2024 assessment notes that a compromise against any level of government can implicate residents' personal information, service continuity and trust in the institutions.
• Defences seen as weak. The same playbook states that small and medium-sized organizations are targeted because actors consider their security measures to be weaker. The Outlook adds that some groups mostly want to increase the number of posts on their leak sites, regardless of victim size.

Why it matters in Quebec

Data theft triggers a second obligation, separate from recovery. The Quebec government's page on confidentiality incidents sets out what sections 63.8 to 63.11 of the Access Act require of a public body: promptly take reasonable measures to reduce the risks, notify the Commission d'accès à l'information and the persons concerned when the incident presents a risk of serious injury and keep a register of all incidents. Municipal bodies are defined in section 5 of that same Act.

A municipality is not alone, though: the ministère de la Cybersécurité et du Numérique lists municipalities and other municipal bodies among the entities to which it may provide its services.

What to do first, in order

For a team of two or three people, the order matters more than the length of the list. The technical measures come from the Centre's two guides.

1. Put two backups out of reach. The playbook recommends two or more backups stored offline, inaccessible from the network or the Internet, and a schedule to test them (for example, monthly).
2. Close the common doors. Regular updates, multi-factor authentication, caution with phishing: the basic practices the Outlook retains.
3. Cut down administrator accounts. The playbook says to limit them to the people who need them and to create separate accounts for email and everyday work.
4. Write the plan on one page. Who decides, who calls, through which channel. The playbook says to assume the actor is still on the network and to set up a communication method the actor cannot access.
5. On the day, isolate, then report. Determine what is infected, disconnect those systems from the Internet and the internal network, then report the attack to local law enforcement, the Canadian Anti-Fraud Centre and the Cyber Centre (My Cyber Portal).
6. Handle the data question in parallel. Assess the risk of injury, record the incident in the register, notify the Commission d'accès à l'information and the persons concerned if the risk is serious.
7. Do not count on the ransom. According to the Outlook, there is no guarantee that the actors will unlock systems or return stolen data, and they can use it to revictimize the organization.

The next step

Ask two questions this week: where is the backup copy the network cannot reach, and who do we call at three in the morning? If either answer is missing, that is your first job. Our incident response page describes how to prepare that plan before the incident.