In August 2018, District staff identified and removed malware that had been installed on the web server that hosts westvancouver.ca by unknown persons. After conducting a comprehensive investigation, the District was unable to find any evidence that personal information stored on the server was compromised, but the possibility of compromise cannot be definitively ruled out. The web server is located off-site behind a separate firewall and is isolated from all other District of West Vancouver servers.
Who is affected?
Persons who used a webform on westvancouver.ca to send information to the District of West Vancouver prior to August 14, 2018.
What is a webform?
Webforms are online forms used for a number of purposes. Once filled out and submitted, an email is sent to the appropriate staff person for action, and the data is stored on the web server.
Uses of webforms include:
- Request for service
- Contact us
- Order recycling boxes or bags
- Feedback on Council initiatives such as the OCP, Arts & Culture Strategy and Proposed Tree Bylaw
- RSVP to a World Café for the Arts & Culture Strategy
- Applications for Community Day: parade, vendors or booths
- Student video contest submissions
- Student summer daycamp volunteers
- Volunteer application forms
- Venue rental requests
- Youth Appreciation Award nominations
- Community Awards nominations
Examples of the personal information contained in these forms may include names, addresses, phone numbers, email addresses, and IP addresses.
What should users do?
No evidence exists that personal information was compromised, however, webform users should always exercise caution if approached by unknown individuals.
What is the District doing?
The District has deleted all personal data from the web server and has temporarily disabled the forms. The District has also taken measures to harden the website security in an effort to prevent future attacks.
Once we are assured that additional security measures put in place are effective, the forms will be enabled again on a limited basis. In the future, data will be removed from the web server on a regular basis.
Could this have been prevented?
Cybersecurity incidents are all-too-common. A regular cycle exists where individuals develop code to exploit website vulnerabilities around the world, website developers develop security patches in response, and organizations such as the District install the security patches in an effort to maintain security. West Vancouver staff check for updates and patches weekly. When patches are released, staff verify them in a test environment, then update the website.
Have any other West Vancouver websites been affected?
No. All District websites have been reviewed and only westvancouver.ca was affected by this incident. The web server is located off-site and are isolated from the District network that hosts all other online services, including westvancouverITE, the Career Portal, and MyDistrict.
For more information contact:
David Neufeld, Records/Information Coordinator