A “fairly significant” cybersecurity breach in St. Marys last summer has exposed flaws in a records retention system that will be addressed by a $53,000 plan pitched in this year’s budget, the Southwestern Ontario town’s top administrator says.
A “fairly significant” cybersecurity breach in St. Marys last summer has exposed flaws in a records retention system that will be addressed by a $53,000 plan pitched in this year’s budget, the Southwestern Ontario town’s top administrator says.
Brent Kittmer outlined the plan to councilors during a budget meeting Tuesday.
It includes purchasing a new electronic records management system and adding a full-time contract position to the clerk’s department, a division at town hall that will also develop a new records retention bylaw this year if the plan is approved.
“It’s funny to say this, but (the cybersecurity incident) is helpful in some ways because it exposed some of the gaps in our organization that we had to close,” Kittmer said during Tuesday’s full-day budget session. “We need to do a better job at how we manage our data.”
A ransomware attack reported in St. Marys in July crippled the town’s computers and forced a shutdown of its network to protect sensitive data.
Very little information about the incident has been publicly released since the town hired cybersecurity experts from Deloitte Canada to investigate how the attack happened and whether the network shutdown was successful.
It was unclear Tuesday whether St. Marys was forced to pay the hackers responsible for the attack, one of several reported in small Southwestern Ontario municipalities in recent years including in nearby Woodstock, Stratford and Central Elgin.
After Tuesday’s meeting, St. Marys Mayor Al Strathdee said Deloitte’s final report is still being held for legal reasons but is “close” to being released to the public.
“I don’t have an exact timeline,” Strathdee said. “I know we’re close but we’re not there yet. We’re all anxious to get it behind us so I’m hoping it comes out sooner than later.”
Kittmer told councilors Tuesday the new contract position in the clerk’s department will bolster the work of two full-time equivalents currently staffed there, but added the clerk’s department and the finance department in St. Marys have both been traditionally understaffed compared to similar-sized towns .
Although the town has taken steps to address staffing levels in both departments over the past couple of years – a 2020 report first highlighted the problem, leading to the creation of the deputy treasurer and finance clerk positions, as well as the separation of the the clerk and CAO roles – July’s cybersecurity incident “exposed one of the consequences of the historical understaffing,” councilors heard.
Provincial rules require Ontario’s municipalities to have a records retention bylaw to guide how it stores and destroys data, including identifiable information about residents. The overhaul of the town’s records retention program pitched in the budget, including the creation of a records retention bylaw, will be a multi-year project, according to council documents.
Wages, inflation putting pressure on St. Marys budget
The fallout of last summer’s cyber attack isn’t the only staffing-related concern St. Marys councilors will need to consider during budget discussions over the next several weeks.
Also in the budget’s first draft is a $77,000 plan to convert seven full-time equivalent contract positions in the town’s childcare programs into permanent jobs. Stephanie Ische, the town’s director of community services, said that move will help reduce the costly turnover of early childhood educators, a role in high demand in Perth County.
“Over the years, the town has relied very heavily on contracted positions to staff the childcare centre,” she said. “It helped … over the years to keep costs down. However, this model does not consider the ongoing costs of recruitment (and) retention.”
St. Marys has lost childcare staff to nearby municipalities because of the temporary nature of those contracts, Ische added.
Staff in St. Marys also want to turn its seasonal recreation programmer into a full-time position, a move that would add capacity to the recreation services department at a cost of about $25,000. Approving the ask would help address gaps in recreation and leisure opportunities for older teens and young adults, council heard, a concern put on the backburner in St. Marys when the pandemic struck in 2020.
Besides wages, which comprised a large chunk of the roughly four per cent tax levy increase that councilors will likely try to whittle down before approval in March, inflation is also having an impact, particularly on public works. That department’s budget has come in around 20 per cent higher than it was in 2022 in large part due to the increasing cost of contracted services.
“Looking at the public works budget, rolled together with parks, it’s definitely not a great story,” Jed Kelly, the town’s public works director, told council.
Councilors asked staff last year not to exceed a two per cent tax levy target in 2023, a mark that will be difficult to reach.
This year’s draft budget in St. Marys included a 3.7 per cent tax levy when it was released. Andre Morin, the town’s director of corporate services, told councilors Tuesday that number is now closer to four per cent after 2022 growth estimates came up about $60,000 smaller than expected.
“Unfortunately, this is the first year I have to report we weren’t able to meet that target,” Kittmer said. “Inflation is certainty having an impact. It’s difficult for six per cent inflation not to impact our budgets.”
If approved, a four per cent tax levy increase would push the tax burden of the median homeowner in St. Marys to nearly $4,900 next year. That figure – for a home with an assessed value of $262,000 – includes utilities and the education tax set by the province. It represents an increase of roughly $150 compared to 2022.
Budget discussions in St. Marys will continue next week, when councilors expect to have more information about shared services the town is partially responsible for, including Huron Perth public health, Spruce Lodge, paramedic services and the Upper Thames River Conservation Authority.
A public information session is planned Feb. 4.