As of the end of February, the Town of Ponoka's investigation into cyber security breach a year ago has concluded.
While the town identified that some personal information was accessed as possibly copied, there is no evidence any of the information was misused as a result of the incident.
"The Town of Ponoka takes privacy and the security of personal information in our care very seriously," stated the release.
When the town learned on March 4, 2024, that part of their network had been accessed by an unauthorized third party, they immediately disconnected their system from the network to prevent further unauthorized activity.
External cybersecurity experts were engaged to assist with containment, remediation and the investigation.
According to the town, the data breach resulted in the loss of two-and-a-half months of data that had to be re-entered which delayed the completion of the town’s 2023 year-end audit.
Town employees sorted through 153,000 lines of data, which included 124,000 compromised files. The final audit sample size was 9,269 files which were
thoroughly inspected, said town administration in their report to council on Feb. 25.
While the town had cybersecurity measures in place before the breach, additional protections have been added, including 24/7 advanced endpoint detection and response monitoring,.
The incident was also reported to the Office of the Information and Privacy Commissioner of Alberta.
The investigation concluded that the information accessed included emails and files such as complaint notifications from residents and resulting follow up; Certificates of Recognition for residents achieving milestone birthdays; vendor quotes; details of Town or AHS enforcement actions related to residential properties, including property owner information; direct banking information for utility customers and direct deposit information for business suppliers.
The town maintains a cyber insurance policy, with a maximum payment of $100,000. The cost of the 2024 cyber incident, excluding ongoing monitoring costs and staff time, was about $110,000 which resulted in a cost to the town $10,000.
The town used three forms of communication to notify impacted individuals and business based upon the severity or confidentiality of information released.
"Generally, the types of personal information provided to the town are insufficient for an unauthorized third party to carry out identity theft or fraud."
Those with questions regarding the data breach can contact Dawn Sauve at dawn.sauve@ponoka.ca or 403-783-0121.
