KRG says recovery from security breach may take months

Kativik Regional Government is still recovering from a security breach that forced a complete temporary shutdown of its internal information technology system in late June.

Both KRG and Quebec provincial police are investigating the breach. A police spokesperson declined further comment this week, citing the ongoing investigation.

The impact on the system isn’t known yet, including whether citizens’ personal information has been compromised.

Staff noticed on June 25 activity that was out of the ordinary during routine checks of the government’s internal network, KRG regional director Paul Parsons said in an interview Tuesday.

“They started to look into it, and they realized it was a cyber incident,” he said.

After bringing all management staff into office on a Sunday, their decision was to shut down the entire internal network. This procedure can only be done under specific conditions.

Since KRG works with satellite internet systems, “we can basically completely disconnect ourselves,” said Parsons.

If KRG were connected to fibre optic internet, he said, that would not have been an option.

Such a procedure has consequences and a toll has been taken on KRG’s internal IT system, he said.

For a week, internal phones and emails were shut down and communications between Nunavik’s 14 communities were at a standstill.

“We’re in that recovery stage,” said Parsons.

“We’re trying to figure out exactly what happened, what consequences may have happened, and how do we stop the bleeding.”

The focus at the moment is recovery, he said. After that, KRG plans to investigate the type of malware that was used in the security breach. Currently, they do not know the cause.

Parsons said KRG can confirm that none of the peripheral organizations working under it were affected by the breach. These include the Nunavik Police Service, air transportation, internet provider Tamaani, and the water infrastructure.

All employee email addresses are being changed, and the IT system will go through a complete overhaul with the hired help of cybersecurity specialists.

“This is something that won’t be done in a few weeks,” Parsons said. “It may be a few months, it could be many months. It’s going to be a while before all of this is behind us.”