MFA for Cyber Insurance: Lessons From Hamilton’s Denied Claim

MFA for cyber insurance sounds like a box on a renewal form, until a claim depends on it. For the City of Hamilton, it did.

On February 25, 2024, the city was hit by ransomware. Its insurer later denied the claim, and the city has been open about what happened since. We use its case here with respect, because Hamilton has published so much about its own incident.

This article tells the story from the city’s own statements and from news reports, then turns it into steps any Canadian business can take. It is not insurance or legal advice. Your policy wording and your broker are the authority on what your own coverage says.

What Happened in Hamilton

The city identified the incident on the evening of Sunday, February 25, 2024, according to its cyber incident page. In a July 30, 2025 update, the city said the attackers came in through an external internet-facing server, studied its systems covertly, then encrypted systems and data. They tried, and failed, to destroy all of the city’s backups.

The same city update says the attackers demanded a ransom of about $18.5 million CAD, and the city did not pay. The city contained the incident within two days, kept critical services running, and recovered most systems directly from backups. Third-party experts found no evidence that personal information or personal health information was stolen.

The disruption was still large. Global News reported that the attack disabled roughly 80 percent of the city’s network, and CP24 reported nearly 80 percent. The city’s own breach notification page lists systems that could not be recovered, including permitting and licensing, Fire Services records management and museum collections management.

Why MFA for Cyber Insurance Decided the Claim

The city’s July 30, 2025 update states it plainly: after a forensic review, the city filed a claim, and its insurer denied it based on coverage terms. A third-party legal review confirmed the denial aligned with the policy, and the city did not pursue further legal action.

The news coverage explains which term. Global News reported that council members were told the claim was denied because multi-factor authentication had not been fully implemented at the time of the attack. CBC News quoted the staff report directly: no coverage was available under the policy for any losses where the absence of MFA was the root cause of a cyber breach.

So this is what MFA for cyber insurance looks like in practice. Here the requirement was not a question on a form. It was a condition in the policy, read after the attack, against what was actually in place on the day.

The City’s Own View

Hamilton’s acting chief information officer, Cyrus Tehrani, sees the cause differently. CBC News reported that he told reporters the breach would have happened even with multi-factor authentication in place, contrary to the insurer’s finding.

That view deserves a fair hearing. The city has consistently described a sophisticated attack through an internet-facing server, and MFA protects logins, not every path into a network. Still, the insurer’s reading of the policy decided the claim, and the third-party legal review agreed with it.

This is the hard lesson in MFA for cyber insurance. You may be right about what would have stopped an attacker. The policy wording still decides what gets paid.

The Requirement Was Known, the Rollout Was Partial

Both outlets reported that the city knew about the requirement before the attack. Global News reported a council member learning at the meeting that the insurer sought MFA in late 2022. CBC News reported that staff knew of the requirement in the fall of 2022 and began a pilot the following year, but only in a few departments.

Rolling out MFA across a large organization takes planning, training and patience. The city’s Auditor General has since described the wider picture. In an October 2, 2025 release, the city acknowledged the findings and said progress on the 2021 audit recommendations was limited.

The same release lists what changed after the attack:

• New leadership: IT now reports to a newly created chief information officer, and the city recruited its first chief information security officer.
• Stronger logins: enhanced security protocols, such as multi-factor authentication, were introduced.
• Better recovery: backup systems were strengthened.

What It Cost

The city’s own figure is the one to use. From the start of the incident to June 30, 2025, the city spent $18.3 million CAD on immediate response, system recovery and third-party expert support, according to its July 30, 2025 update, citing Report CM24005(b).

Global News and CP24 reported the same $18.3 million. CBC News reported $18.4 million spent to date, so where the outlets differ, this article uses the city’s published figure. With the claim denied, Global News reported that the city faces the full bill.

What Insurers Look For, in General Terms

Every policy is different, so the only reliable answer is in your own policy and your own application. What we can say in general terms comes from neutral sources, not insurer marketing.

The Insurance Bureau of Canada lists the measures it wants small and medium businesses to have in place, sourced to the Canadian Centre for Cyber Security. One of them is strong user authentication: “Wherever possible, use multi-factor authentication (MFA).” The same list includes an incident response plan, patching, tested backups, security software and staff training.

That list is a fair starting point for any talk with your broker about MFA for cyber insurance. In Hamilton’s case, the answer that mattered was the one checked after the claim.

Getting MFA for Cyber Insurance Right

The Canadian Centre for Cyber Security’s guidance, Secure your accounts and devices with multi-factor authentication, recommends using MFA where possible to protect high-value business services and data. It also tells organizations to mandate MFA for users and administrators on cloud and internet-connected services, especially where sensitive data is involved.

The same guidance warns that MFA can be bypassed through MFA fatigue, token theft and machine-in-the-middle attacks. It suggests number matching, phishing-resistant options such as FIDO-based solutions, and a limit on repeated MFA requests.

Here is how we would turn that into a plan:

1. List every login that matters: email, VPN and remote access, cloud apps, the accounting system, and every administrator account, including the ones your IT provider holds.
2. Close the gaps by account, not by department: a pilot in a few teams is a start, and Hamilton’s case shows what a partial rollout can mean at claim time.
3. Turn on number matching and limit push requests, so a tired employee is less likely to approve an attacker by accident.
4. Use phishing-resistant MFA for administrators where your systems support it.
5. Plan for lost devices: the guidance calls for a clear recovery process for lost or compromised authentication factors.
6. Keep the proof: an exported report showing MFA enforced on each account, dated, saved where you can find it at renewal and after an incident.

Do not skip the last step. MFA for cyber insurance is about what you can show, on paper, for the day of the attack.

Read Your Policy Before You Need It

Hamilton’s insurer read the policy after the attack. You can read yours now, with MFA for cyber insurance as the first line you check. Ask your broker to walk you through any condition or exclusion tied to security controls, and write down what each one requires.

Then compare that list with what is actually running. If the application says MFA is on everywhere and it is on in some places, close the gap or correct the answer before renewal.

Where Secur-IT Data Fits

Our team works on MFA for cyber insurance from the controls side, not the policy side. The cyber insurance readiness check starts with nine quick questions.

From there, a Toronto analyst reviews the controls insurers check, helps you answer the underwriting questionnaire, and gives you a prioritized plan. The questionnaire review is free for small offices, and an on-site assessment is quoted after a short scoping call.

For ongoing work, our cyber protection program for SMBs has three tiers:

• SMB Cyber Health Check: a review of Microsoft 365 or Google Workspace configuration, including MFA and admin accounts, plus email, endpoints, backups and internet-facing systems.
• Managed SMB Protection Essentials: managed endpoint protection and EDR, 24/7 monitoring and alerting, email security, and quarterly security reviews aligned to your cyber insurance requirements.
• SMB Cyber Resilience and Compliance Program: risk assessment, the security documentation customers and cyber insurers expect, and incident response planning with tabletop exercises.

Your IT provider keeps running your systems. We watch them, and we help you keep your MFA for cyber insurance evidence ready for renewal.

Frequently Asked Questions

Q: What does MFA for cyber insurance mean?

MFA for cyber insurance means having multi-factor authentication in place the way your policy and application describe it, and being able to prove it. In the Hamilton case, as reported by Global News and CBC News, the policy gave no coverage for losses where the absence of MFA was the root cause.

Q: Why was the City of Hamilton’s claim denied?

The city says its insurer denied the claim based on coverage terms, and a third-party legal review confirmed the denial aligned with the policy. News reports, citing a staff report, said MFA had not been fully implemented at the time of the attack.

Q: Does the city agree MFA would have stopped the attack?

Not according to its acting chief information officer. CBC News reported that Cyrus Tehrani said the breach would have happened even with MFA in place, but the insurer’s finding still decided the claim.

Q: How much did the Hamilton attack cost?

The city’s July 30, 2025 update reports $18.3 million CAD spent from the start of the incident to June 30, 2025, on response, recovery and expert support. The ransom demand was about $18.5 million CAD, and the city did not pay it.

Q: What kind of MFA does the Canadian Centre for Cyber Security recommend?

It recommends MFA where possible, mandatory for users and administrators on cloud and internet-connected services. It also suggests number matching, limits on repeated requests and phishing-resistant options such as FIDO-based solutions.

If you want to know where MFA is missing in your business today, and what your renewal answers should say, our team at Secur-IT Data can walk you through it.

References

1. City of Hamilton: Cybersecurity Update, City provides more incident details, including ransom amount (July 30, 2025)
2. City of Hamilton: City Responds to Office of Auditor General Cyber Security Follow Up Audit (October 2, 2025)
3. Global News: Ontario city facing full $18.3M cyberattack bill after insurer denies claim
4. Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)
5. Insurance Bureau of Canada: Cyber safety

Krikor Tengerian

Krikor Tengerian is the CEO and founder of Secur-IT Data Solutions, a Toronto-based cybersecurity firm focused on helping Canadian organizations secure their infrastructure and critical systems. With over 25 years of experience across cybersecurity and IT infrastructure, he has supported organizations in hardening networks, protecting critical workloads, and aligning security controls with business and regulatory requirements.​
Krikor actively shapes the direction and themes of Secur-IT’s educational content, collaborating with AI tools to structure, refine, and expand articles while providing the real-world context, use cases, and review to keep them accurate and practical for readers. He regularly shares insights on OT security, threat detection, incident response, and Canadian cybersecurity compliance to help industrial and commercial organizations better understand and reduce their cyber risk.