So You've Been Hacked - A new generation of ultra-sophisticated cybercriminals are targeting governments, corporations, hospitals and libraries and laying bare how ill-equipped Canada is to fight back

A new generation of ultra-sophisticated cybercriminals are targeting governments, corporations, hospitals and libraries and laying bare how ill-equipped Canada is to fight back.On a July morning in 2022, Brad Hynes, the IT manager for the town of St. Mary's in southwestern Ontario, was backing up the town's computer systems when things went haywire. File names became unintelligible strings of characters. Desktop icons went blank. File after file was impossible to open, a string of digital duds. The background wallpaper on Hynes's screen disappeared, replaced by the red-and-black logo of a Russian ransomware gang called LockBit. A line of all-caps text appeared: All your important files are stolen and encrypted!

- By Caitlin Walsh Miller- Illustration by Anna Minzhulina

On a July morning in 2022, Brad Hynes, the IT manager for the town of St. Mary's in southwestern Ontario, was backing up the town's computer systems when things went haywire. File names became unintelligible strings of characters. Desktop icons went blank. File after file was impossible to open, a string of digital duds. The background wallpaper on Hynes's screen disappeared, replaced by the red-and-black logo of a Russian ransomware gang called LockBit. A line of all-caps text appeared: All your important files are stolen and encrypted!

Hynes immediately took the town's systems offline to prevent the hackers from digging into anything they hadn't already compromised. Then he called the town's CAO, who called his boss, Mayor AI Strathdee. Strathdee was on the highway, driving back to town from meetings in Toronto and, like Hynes, he didn't know what to do. There was no playbook for this situation-except the one provided by the hackers themselves. A file called Restore-My-Files.txt had been dropped into every compromised directory, with instructions for logging on to the dark web, the internet's seedy underbelly, an online space used for criminal purposes of all kinds, accessible only through special browsers. The note included instructions on how to use one such browser called Tor. It didn't specify how much ransom the town was expected to fork over, explaining that LockBit would provide chat support and further instructions on how to pay with cryptocurrency. Otherwise, 67 gigabytes of data-including confidential information on town financials, infrastructure and services-would be posted to LockBit's leak site, a darkweb location where ransomware hackers sometimes publish material they steal as a pressure tactic.