The Rural Municipality of Gimli, Manitoba, has completed its investigation into a late-April cyber security incident and made its findings public on June 18, 2026. The investigation looked into what happened, what data may have been affected, and how the municipality has responded.
The problem began on April 27, 2026, when the attack was discovered, and the municipality notified residents the following day, April 28, while bringing in a cybersecurity firm to investigate. The attack was later claimed by a ransomware group called Payload. During the disruption, the municipal office could not process bill payments, so residents were told to pay directly at their banks. A scheduled council meeting was also cancelled on short notice.
According to threat reports, Payload claimed to have locked up files and stolen sensitive municipal information, threatening to release it if their demands were not met. The attack on Gimli was one of 32 ransomware attacks in Canada in April 2026—a 23 percent jump from the 26 attacks seen in March.
Cybersecurity expert Marc Perreault said smaller municipalities like Gimli are often seen as easy prey by criminals because they usually have fewer technology staff and resources. “If you look at it from the attacker’s perspective, municipalities are generally not heavily staffed, especially in terms of technology,” Perreault said. “So they are a fairly easy target, knowing that potentially, there’s far less eyes on the system.”
Residents who want to see the findings or need more information can visit the Rural Municipality of Gimli website.
