Winkler, Manitoba, Latest Manitoba Municipality Hit by Cybersecurity Incident
The City of Winkler, located 115 kilometres southwest of Winnipeg, is the latest Manitoba municipality to face a cybersecurity incident. On Tuesday morning, the city’s security systems detected an anomaly, prompting officials to isolate affected systems and take several municipal services offline as a precaution.
Phone and payment systems remain unavailable as the city works to assess and resolve the issue. Mayor Henry Siemens stated that Winkler’s strong IT team and prior investments in cybersecurity may have helped mitigate the impact, though the full extent of the incident is still under investigation.
External cybersecurity experts and law enforcement have been engaged to assist with recovery efforts. Siemens confirmed that it is too early to determine whether personal data belonging to staff or residents has been compromised. If any breaches are discovered, the city will follow appropriate notification procedures.
Several other Manitoba municipalities have faced similar disruptions in recent years. In April, the RM of Gimli experienced a cybersecurity incident, with the ransomware group Payload claiming responsibility and threatening to release sensitive data. The RM later restored its systems. The RM of Ritchot also reported a cybersecurity incident in December 2024, while WestLake-Gladstone suffered a major financial loss in 2019–2020, with nearly $470,000 stolen in a cyberattack.
The Association of Manitoba Municipalities has acknowledged the growing threat, noting that cyber risks are becoming more frequent and complex. Cybersecurity consultant Ritesh Kotak highlighted that municipalities are prime targets due to the valuable personal data they hold, with smaller communities often more vulnerable due to limited resources for security upgrades.
Winkler’s recovery efforts are ongoing, with city hall, public works, and the Meridian Exhibition Centre administration offices closed through Friday. However, critical services, including drinking water, remain operational, and the Winkler Aquatic Centre and Meridian Exhibition Centre are running as scheduled. Further updates will be provided as the investigation progresses.
Source: https://www.winnipegfreepress.com/breakingnews/2026/07/09/city-of-winkler-hit-by-cyberattack
City of Winkler TPRM report: https://www.rankiteo.com/company/city-of-winkler
"id": "cit1783635987",
"linkid": "city-of-winkler",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "60",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'customers_affected': 'Residents and staff',
'industry': 'Government',
'location': 'Winkler, Manitoba, Canada',
'name': 'City of Winkler',
'type': 'Municipality'}],
'customer_advisories': 'Further updates will be provided as the investigation '
'progresses',
'data_breach': {'sensitivity_of_data': 'Personal data of staff or residents '
'(potential)'},
'date_detected': '2023-11-14T00:00:00Z',
'date_publicly_disclosed': '2023-11-14T00:00:00Z',
'description': 'The City of Winkler, located 115 kilometres southwest of '
'Winnipeg, is the latest Manitoba municipality to face a '
'cybersecurity incident. On Tuesday morning, the city’s '
'security systems detected an anomaly, prompting officials to '
'isolate affected systems and take several municipal services '
'offline as a precaution. Phone and payment systems remain '
'unavailable as the city works to assess and resolve the '
'issue.',
'impact': {'operational_impact': 'Municipal services taken offline, city '
'hall, public works, and Meridian Exhibition '
'Centre administration offices closed '
'through Friday',
'systems_affected': 'Phone and payment systems'},
'investigation_status': 'Ongoing',
'references': [{'date_accessed': '2023-11-14T00:00:00Z',
'source': 'City of Winkler Announcement'}],
'response': {'communication_strategy': 'Updates to be provided as '
'investigation progresses',
'containment_measures': 'Isolated affected systems, took '
'municipal services offline',
'incident_response_plan_activated': True,
'law_enforcement_notified': True,
'recovery_measures': 'Ongoing recovery efforts',
'third_party_assistance': 'External cybersecurity experts'},
'title': 'Cybersecurity Incident at City of Winkler',
'type': 'Cybersecurity Incident'}