Community that lost $472,000 to cyber attack failed to investigate: auditor general

Manitoba's auditor general says a rural municipality failed to properly investigate the cause of cyber attack that resulted in hundreds of thousands of dollars being siphoned from its coffers. The exterior of the Manitoba Legislature is seen in Winnipeg, Wednesday, Nov. 6, 2024. THE CANADIAN PRESS/John Woods

WINNIPEG — Manitoba’s auditor general is suggesting the province should have more oversight over the operations of municipalities following an investigation into allegations of financial mismanagement, improper governance practices and lack of accountability measures.

Over the course of a year, Tyson Shtykalo investigated claims against six municipalities, with some of the allegations dating back as far as five years.

The investigation stemmed from cybersecurity breach over the course of a few weeks in 2019 and 2020 that led to the Municipality of Westlake-Gladstone, west of Winnipeg, losing more than $472,000. The former Progressive Conservative government requested a probing of the incident.

His 34-page report released on Thursday argues that the department of Municipal and Northern Relations “lacks a comprehensive oversight process for municipalities.”

“The (province) provides significant funding to municipalities to support local governance, infrastructure and services,” Shtykalo said in a statement.

“With this funding comes a responsibility -- both for municipalities and the Department of Municipal and Northern Relations -- to ensure effective stewardship of public resources.”

The report found the department generally doesn’t follow up on complaints submitted by members of the public against municipalities, its oversight of government grants is insufficient and it lacks checks and balances when reviewing a municipality’s financials.

It includes five recommendations to strengthen oversight of public funds provided to municipalities and improve cybersecurity.

Between Dec. 19, 2019, and Jan. 5, 2020, there were 48 withdrawals made from an account held by the Municipality of Westlake-Gladstone. The withdrawals, each just under $10,000, amounted to $472,377 taken from the account before authorities were notified.

A review found that the municipality did not perform an investigation at the time to determine the root cause of how someone was able to access its online banking without authorization.

Officials with Westlake-Gladstone could not be immediately reached for comment.

“A key step in responding to a cybersecurity incident is prompt investigation,” the report said. “This is because as time passes the incident becomes more challenging to investigate.”

Shtykalo recommends municipalities implement baseline cybersecurity controls, such as those recommended by the Canadian Centre for Cyber Security, and that the province develops processes to monitor whether municipalities are doing this.

The province said in the report it would partner with Manitoba Municipal Administrators and the Association of Manitoba Municipalities to survey communities on their current cybersecurity practices, but added it respects the authority of elected officials to govern appropriately.

“Manitoba’s legislative framework for municipalities respects their autonomy as democratically accountable governments and does not provide prescriptive requirements for how municipalities conduct their internal operations,” the department of Municipal and Northern Relations said in response to the recommendation.

The investigation looked at complaints against six municipalities - ultimately finding three of the allegations were at least partially substantiated, revealing unauthorized expenditures, governance failures and improper procurement.

There were complaints that councillors in the Rural Municipality of Springfield claimed ineligible expenses over the course of a nine-month period.

The investigation found approximately $3,000 was paid out from January to October 2022 for travel, despite bylaws outlining that only time spent engaged in business is claimable.

The mayor of the rural municipality said on Thursday he had not seen the report and would withhold comment until he read over it.

In the Municipality of Ethelbert, the investigation found documentation that showed several instances of improper governance by the former head of council, including reimbursing travel without knowledge or approval of council, conflict of interests when tendering contracts and ordering water and sewer lines without consulting proper department officials resulting in errors and an expense of several thousand dollars.

No one from the municipality responded to immediate requests for comment.

In 2022, the Municipality of Swan Valley West purchased two fire trucks without tendering, which is a violation of its purchasing policies, the report found.

The municipality’s reeve received the report and said the current council has done a better job of following the rules.

“Nobody set out to do something wrong. I believe the people that did it thought they were doing what they needed to do to make the municipality better and protect the municipality, but they maybe didn’t have the knowledge of how to do it properly,” Bill Gade said in an interview.

Gade said he used to believe that the province should take a stronger hand in municipalities, but now argues that what community officials need is more education.

“There’s no qualifications to be on council except winning an election.”

The report also recommends the province develop an approach of reviewing cases of financial mismanagement and non-compliance when issuing grants, create a process for when municipalities are non-compliant, like withholding funds or implementing financial penalties, and it conduct a more thorough review of a municipality’s financial plans.

This report by The Canadian Press was first published Aug. 28, 2025.

Brittany Hobson, The Canadian Press