City of Winkler hit by cyberattack

Winkler has become the latest Manitoba municipality to grapple with cybersecurity incidents.

On Tuesday morning, the city’s cybersecurity protection systems detected an incident, prompting officials to isolate affected systems and take certain municipal systems and services offline as a precaution while the situation is assessed.

Phone and payment systems are unavailable as the city, about 115 kilometres southwest of Winnipeg, works to resolve the issue.

“We’re fortunate that we have a very good IT team, and security has always been a significant investment for us,” Winkler Mayor Henry Siemens said. “So we were maybe better prepared than others potentially would have been because of the strength of our staff and the strength of our security protocols.”

Several Manitoba municipalities have had to contend with cyber incidents in recent years.

In April, the RM of Gimli announced that its information technology systems had been affected by a cybersecurity incident. Around the same time, the ransomware group Payload claimed responsibility for an attack on the municipality and threatened to release sensitive municipal data unless its demands were met. The RM has not confirmed whether Payload was responsible for the incident.

About a month later, Gimli said its systems had been restored.

The RM of Ritchot experienced a cybersecurity incident in December 2024 that disrupted municipal servers and systems.

In one of Manitoba’s most significant municipal cyber incidents, about $470,000 was stolen from an account belonging to the Municipality of WestLake-Gladstone in a cyberattack between December 2019 and January 2020.

“The Association of Manitoba Municipalities recognizes that cybersecurity is an increasing concern for municipalities across the province as cyber threats become more frequent and complex,” the organization said in a statement provided to the Free Press on Thursday.

“As the province advances cybersecurity governance initiatives, the (association) will continue to advocate for a collaborative approach to establishing baseline cybersecurity controls and guidance for municipalities, particularly in response to recommendations identified by the auditor general.”

Toronto cybersecurity consultant Ritesh Kotak said cyber attacks on municipal governments are becoming increasingly common as more public services rely on digital systems.

“Our lives are becoming more digital, and so is the infrastructure,” he said. “As a result, if the appropriate cybersecurity measures are not put in place and there aren’t business continuity plans, systems will go down.”

Kotak said municipalities are attractive targets because they store valuable personal information.

He added that smaller municipalities can be more vulnerable because they often have fewer resources to invest in cybersecurity and legacy system upgrades.

“Traditionally, what we’ve seen is larger municipalities have made the investment compared to smaller municipalities,” Kotak explained.

Siemens said Winkler has engaged external cybersecurity experts and specialists to assist with the investigation and recovery efforts and police have been notified.

“At this time, we don’t know whether any personal information has been compromised — staff, residents or anything like that at all,” Siemens said. “If we do find that personal information has been affected, appropriate notification procedures will be followed.”

Siemens said it will likely be several days before the city has a full understanding of the nature of the cybersecurity incident.

“It’s a little too early to tell,” he said.

“We’re focused on restoring our services as quickly as possible, but we’re doing all of that in a very controlled, secure manner. We’re busy testing absolutely everything before we bring it back online. We’re testing our backups to find out if any of them have been compromised, and that is an extremely slow, very tedious process.”

City hall, public works and the Meridian Exhibition Centre administration offices will remain closed today and Friday.

The Winkler Aquatic Centre and Meridian Exhibition Centre are operating as scheduled.

The city said critical municipal services continue, drinking water remains safe, and further updates will be provided as more information becomes available.

“This is something that, for all municipalities, is a really big concern,” Siemens said.

zoe.pierce@freepress.mb.ca