Saint John businesses should plan for continuity first. The City of Saint John was hit by ransomware on November 13, 2020, took its network offline, paid no ransom and projected recovery costs of just over 2.95 million, per Global News. Small firms serving the port, refinery and logistics sector face disruption and supplier questionnaires. Start with multi-factor authentication, a tested restore, a manual fallback for your three critical processes and a read of your cyber insurance conditions.
What a port and refinery city has to protect
Saint John's economy is built around moving and processing physical goods, and its security problems look different from an office city's. The public facts we could verify:
- The refinery. Irving Oil says its Saint John refinery, opened in 1960, processes more than 320,000 barrels of crude a day, employs over 1,600 people, and sends over half of its finished products to the northeastern United States. The company calls it Canada's largest refinery; that is the company's own claim.
- The marine terminal. Irving says its Canaport terminal in Saint John unloads most of the crude oil it receives by ship, and can store more than six million barrels.
- The port. Port Saint John describes itself as a key driver of the province's gross domestic product, says its infrastructure modernization project generated more than 1,400 person-years of direct and indirect jobs in construction alone, and points to the J.D. Irving Lancaster Logistics Park as an early sign of a logistics cluster.
- The university. The University of New Brunswick has a Saint John campus alongside Fredericton, according to UNB.
We deliberately leave out cargo tonnage figures: the most recent number we could source from a primary page is from 2010, and we would rather give you no number than a stale one.
For a small business that works with this ecosystem, such as trucking, marine services, engineering, equipment suppliers, staffing or office services, the risk is rarely a direct attack on a refinery. It is a disruption to you that cuts off your customer, or an attack that reaches your customer through you.
The one real New Brunswick incident worth knowing: Saint John, 2020
On November 13, 2020, the City of Saint John discovered a ransomware attack and disconnected its network from the internet. The details below come from Global News coverage of the city's own statements and reports.
| Fact | What was reported |
|---|---|
| Discovery | November 13, 2020; systems disconnected from the internet as soon as it was found |
| Service impact | Many online services went down, including the city website; parking enforcement was halted; building permits could not be issued |
| Ransom | City officials said no ransom was paid and did not reveal the demand |
| Data | The city manager said it was not believed personal identifying information such as banking details was stolen |
| Recovery cost | A city report projected just over 2.95 million for consulting, hardware, licences and support, with more costs expected |
| Insurance | Up to 85 percent (about 2.5 million) was expected to be covered by two cyber insurance policies with AIG, depending on the insurer's written position |
| Approach | The city chose to rebuild its network rather than comply with the attackers |
Sources: Global News reports from January 2021 and March 2021. CBC also covered the attack at length; we did not rely on those pages here.
What a small business can take from it, without exaggerating the comparison:
- The disruption was operational before it was financial. Permits, parking and online services stopped. A small firm should ask which three processes it cannot do without, and how it would run them on paper for a week.
- Disconnecting was the first move. The city took its systems off the internet as soon as the attack was found. Your staff need to know who can make that call and how.
- Insurance covered most of the bill, but not all, and not automatically. Coverage depended on the insurer's written position after proof of loss. Read your policy's conditions now, including what security controls it expects.
- Rebuilding was a choice the city could make. Starting over is only realistic if you have clean backups and an inventory of what you run.
For a broader look at incidents and what to do, read our New Brunswick cyberattack lessons article and the ransomware protection playbook.
Operations first: continuity for a logistics and industrial city
Many Saint John small businesses support operations that cannot pause: deliveries, vessel schedules, maintenance windows, site access and invoicing. Plan around continuity, not only prevention.
- List your critical three. Which three processes stop revenue if they stop? Dispatch, quoting, payroll, invoicing, a customer portal, a cloud accounting login?
- Write the manual fallback. Paper dispatch sheets, a phone tree and an offline copy of key customer contacts feel old-fashioned until the network is down.
- Know your recovery time. If your main file server or line-of-business system failed today, how long to restore it? Test it. Backups that have never been restored are a hope, not a plan (see the 3-2-1 backup rule).
- Segment what you can. Keep guest Wi-Fi, office devices, cameras and any equipment controllers on separate networks so one compromised device does not reach everything.
- Control remote access. Remote desktop and vendor access should require multi-factor authentication and be switched off when not in use.
Supply-chain exposure: when your customer is the target
If you serve large industrial, marine or logistics customers, your systems may be a path into theirs, and they may ask you for evidence. Typical requests include:
- Proof that employees use multi-factor authentication.
- A description of how you patch and back up.
- Whether you can report an incident quickly, and to whom.
- Where data is stored and who can see it.
A managed provider can help you implement and document these controls. It cannot grant you eligibility for any contract. Always follow the wording of the contract itself.
A note on operational technology: control systems for industrial plant, vessel equipment and building controls are specialised. We do not claim engineering expertise in them. If your equipment is controlled by that kind of system, involve the equipment vendor or a qualified specialist, and use general IT security for the office side of your business.
A 10 minute Saint John checklist
- ☐ Multi-factor authentication is on for email, remote access and accounting
- ☐ You know who can disconnect the network from the internet, and how
- ☐ The three operations you cannot lose have a written manual fallback
- ☐ A full restore test has been done this year
- ☐ Your cyber insurance policy has been read for conditions and exclusions, if you have one
- ☐ Vendor and contractor remote access is limited and logged
- ☐ A short incident contact sheet is stored somewhere that does not depend on your network
Privacy rules for a Saint John business
Most private businesses handling personal information in commercial activity look to federal PIPEDA. Health custodians in New Brunswick are governed by PHIPAA, with a federal order exempting them from Part 1 of PIPEDA for personal health information collected, used and disclosed in the province (SOR/2011-265; we read the proposed order, so verify the registered text). Public bodies, including municipalities such as the City of Saint John, fall under RTIPPA, where government guidance says affected individuals are told when a breach poses a risk of significant harm and the Ombud is notified. This is general information, not legal advice. See the New Brunswick privacy law guide.
How we work with Saint John businesses
We start with an assessment of your accounts, devices, data and backups, and return a prioritized plan. Ongoing protection can include endpoint detection and response, multi-factor authentication, email filtering, patching and backup monitoring. We do not publish a Saint John rate card; the general cost ranges are on our New Brunswick managed IT services page.
Delivery is remote. TechCare Canada publishes independent guidance and routes hands-on work through IT Cares, a Quebec-based partner. We have no Saint John office or staff, and onsite attendance at a Saint John address is confirmed case by case in writing. We do not promise response times here.
Related reading
- Other New Brunswick cities: Moncton and Fredericton
- Province articles: privacy law, cyberattack lessons, managed IT cost
- National guides: small business cybersecurity, managed IT services in Canada, ransomware recovery
Frequently asked questions
What happened in the City of Saint John ransomware attack?
The city discovered a ransomware attack on November 13, 2020 and disconnected its network. Global News reported that online services went down, parking enforcement stopped and building permits could not be issued. The city said no ransom was paid, chose to rebuild, and projected recovery costs of just over 2.95 million.
Was the Saint John attack covered by insurance?
A city report cited by Global News said up to 85 percent, about 2.5 million, was expected to be covered by two cyber policies with AIG, depending on the insurer's written position. Read your own policy's conditions.
What should a small Saint John business learn from it?
Plan for operational disruption, know who can disconnect the network, keep tested backups and a manual fallback for critical processes, and check your insurance conditions in advance.
Do you secure industrial control systems?
No. We do not claim engineering expertise in operational technology. We focus on office IT security, and we recommend involving the equipment vendor or a qualified specialist for plant and vessel systems.
Do you have a Saint John office?
No. Service is delivered remotely, with hands-on work fulfilled by IT Cares in Quebec. Onsite attendance is confirmed case by case in writing.
Get a security review for your Saint John business
Tell us what you do, who you serve and the systems you cannot do without. We reply with a prioritized plan and confirm in writing what can be done remotely and whether onsite is possible.
No payment, no obligation. Hands-on work is fulfilled by IT Cares.