New Brunswick Cyberattack Lessons for Small Business: What Saint John and NB Liquor Teach

2026-10-26 · 9 min read

A note on what we could and could not verify

Small private businesses rarely announce incidents, and journalists rarely have the details. For this guide we searched for confirmed New Brunswick incidents and kept only those with fetched, dated reporting. Two met that bar. Everything else we mention about small businesses comes from national data. Where a figure comes from a news report rather than an official filing, we say so. We do not name any NB company that was not named in published coverage.

Incident 1: City of Saint John, November 2020

According to reporting by Insurance Business, routine monitoring discovered the ransomware on November 13, 2020. The city publicly disclosed a significant cyber attack on Sunday, November 15. Security Affairs, summarizing the city's updates, reported that the entire municipal network was shut down, including the website, online payment systems, email and customer service applications, while critical functions such as transit and water and wastewater treatment kept running. The Saint John Police Force investigated with the National Cybercrime Coordination Unit and the New Brunswick RCMP Digital Forensics Unit. Global News reported on November 18 that Mayor Don Darling confirmed the network had been hit with ransomware.

Recovery was not quick. Early statements spoke of "weeks, not days." A report to council, covered by Global News on March 31, 2021, described the attack as wide-reaching and said the city chose to rebuild its network rather than repair it. Projected recovery costs were just over $2.95 million, and up to 85 percent, about $2.5 million, might be covered by two cyber insurance policies, with the rest coming from the operating budget and reserves. Insurance Business put the cost at about $2.9 million with roughly $400,000 coming from IT reserves, and listed three vendor line items: $1.1 million to Bulletproof Solutions for containment and recovery, $220,000 to FireEye Mandiant for forensic investigation, and $52,000 to CYPFER for ransomware recovery and payment facilitation. The same outlet reported that the attackers demanded between $17 million and $20 million in bitcoin and that the city refused to pay. The city itself did not disclose the demand, so treat that range as reported, not official. The city manager said no sensitive or personal information appeared to have been compromised.

Incident 2: Fredericton and Bathurst, the same week

The Saint John attack did not stay local in its effects. Global News reported that Fredericton's chief information officer, Adam Bell, said logs showed the same attack against the city three or four days after Saint John, with roughly 25 to 30 attempts in total. Fredericton's network remained intact, but phishing attempts rose dramatically. Bathurst reported no increase in suspicious activity but said it was reviewing its security practices. Bell's view, as reported, was that cybercriminals tend to repeat successful attacks and often focus on nearby targets. That is one official's observation, not a statistic, but it is a useful reminder: when a neighbour is hit, your risk that week is higher, not lower.

Incident 3: NB Liquor, January 2025

A Canadian Press report carried by Global News on January 20, 2025 said NB Liquor, the Crown corporation that runs the province's liquor and cannabis stores, found "some anomalies" in its credit payment systems on January 7. Card transactions were suspended for almost two weeks, and stores were closed for more than two days. A spokesperson said the organization was not hit by a ransomware attack and that customers' personal information was not affected. The corporation had not explained the cause, and outside experts were investigating at the time of reporting. We do not know more than that, and we will not guess. The business lesson does not depend on the cause: when payment systems stop, a retailer's whole day stops.

What happened and what to do: the side-by-side

The table pairs each documented fact with the action a small business can take. The right-hand column is our analysis, not a finding from the sources.

The national numbers behind the New Brunswick stories

Statistics Canada's survey of businesses with 10 or more employees found that about 1 in 6 (16%) Canadian businesses were impacted by cyber security incidents in 2023, down from 18% in 2021 and 21% in 2019. Recovery spending roughly doubled, from about $600 million in 2021 to $1.2 billion in 2023, with medium-sized and small businesses each spending about $300 million. Over 1 in 8 impacted businesses (13%) reported ransomware, up from 11%, and 88% of those victims did not pay a ransom. Scams and fraud were the most common method at 50%, followed by identity theft at 31%, up 11 percentage points. The survey excludes firms under 10 employees and public administration, so it understates the very smallest businesses and does not describe New Brunswick separately. Statistics Canada suggests that fewer businesses are being hit but the consequences are getting more severe.

Put differently: the odds that any single business is hit in a year are lower than the headlines suggest, and the cost when it happens is higher than most owners assume. That is the shape of risk that insurance, backups and a written plan are designed for.

Scale these lessons down: a one-week plan for a 5 to 50 person business

The Canadian Centre for Cyber Security publishes 13 baseline controls for small and medium organizations. Five of them map directly to the incidents above. Use this as a one-week starting plan.

1. Day 1, incident response plan (control 3.1). One page: who decides, who calls the insurer, who calls the forensics firm, who talks to customers. Print it.
2. Day 2, patching (control 3.2). Turn on automatic updates for operating systems and key apps and replace products the vendor no longer supports.
3. Day 3, strong authentication (control 3.5). Two-factor on email, accounting, banking and remote access first. Our MFA setup guide walks through it.
4. Day 4, backups (control 3.7). Back up essential data to a secure, encrypted, offsite location and run one test restore.
5. Day 5, awareness training (control 3.6). Thirty minutes on recognizing malicious emails and links, using a real example from this week's news.
6. Day 6, vendor list (control 3.10). Write down every outsourced service that touches your data and who you would call at each.
7. Day 7, rehearse. Read the plan aloud with two colleagues and ask: if email were gone for three days, what would we do?

For the step-by-step response, use our ransomware incident response playbook and the ransomware recovery overview. If personal information may be involved, the legal side is in our NB privacy law guide.

Why this matters in a province of small businesses

Innovation, Science and Economic Development Canada's Key Small Business Statistics report counted 20,631 employer businesses in New Brunswick in December 2024. Of those, 20,256 (98.2%) were small, meaning 1 to 99 paid employees, 325 were medium-sized and 50 were large. The organizations in the headlines are the exception. The typical NB employer looks like a local contractor, clinic, shop, accounting practice or manufacturer with a handful of people and one person who "looks after the computers" on the side. That person rarely has a written plan, and that gap is where a bad week turns into a bad quarter.

We are not saying every small firm needs a managed provider. Some do well with a part-time internal lead and the five-step plan above. If you are comparing options, our co-managed IT explainer and MSP selection checklist help you ask the right questions, and the New Brunswick managed IT cost guide shows what published price ranges look like and what is usually billed separately.

Where to go next

Read the New Brunswick privacy law guide to see which breach rules apply to you. Review managed IT services in New Brunswick, and the cybersecurity pages for Moncton, Fredericton and Saint John. The national hubs are Managed IT Services in Canada and Small Business Cybersecurity.

Sources used

• Global News, Cyberattack on Saint John, Fredericton targeted (Nov 18, 2020)
• Security Affairs, A cyberattack crippled the IT infrastructure of the City of Saint John (Nov 22, 2020)
• Global News, Report on Saint John cyberattack recovery (Mar 31, 2021)
• Insurance Business, AIG Canada to foot part of city's $2.9 million cyberattack bill
• Global News (Canadian Press), NB Liquor resumes credit and debit transactions (Jan 20, 2025)
• Statistics Canada, Impact of cybercrime on Canadian businesses, 2023
• Innovation, Science and Economic Development Canada, Key Small Business Statistics
• Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

News figures are as reported at the time and may have been revised. Hands-on work for our clients is fulfilled remotely through our partner IT Cares in Quebec.

FAQ