On Oct. 21, global financial analytics company S&P Global Ratings downgraded the City of Hamilton’s credit rating as part of their annual credit rating review.
The city’s new long-term issuer credit and senior unsecured debt rating is now “AA+”, down from its previous “AAA” rating.
The research update from S&P says, “The City of Hamilton continues to face substantial delays in reconciling and compiling audited financial statements since the February 2024 cyberattack.”
“This persistent delay in data recovery underscores gaps in the city’s financial management practices, particularly risk management, that are not consistent with similarly rated peers.”
“These challenges in data recovery, in our view, reflect weaknesses in financial management, particularly with regard to transparency, disclosure, and risk management practices.”
Meanwhile, in a City of Hamilton press release on the downgrading, City Manager Marnie Cluckie said that the city is “financially resilient, well-managed, and focused on continuous improvement.”
It should be noted that the city recently had their cyberattack insurance claim denied, which means that taxpayers are on the hook for more than $18 million in cyberattack recovery spending.
A report recently brought forward to Hamilton City Council said that the absence of multi-factor authentication was the root cause of the breach.
Multi-factor authentication is a basic security process that requires users to provide at least two forms of identity verification to access an account or device.
Since the city did not have that process in place, according to their cyberinsurance policy, no coverage is available for any of the resulting losses.
The City of Hamilton’s Office of the Auditor General also released a report at the beginning of October that determined that city staff were warned of “critical weaknesses in the city’s security posture” in a 2021 audit, three years before the cyberattack.
The Auditor General says that recommendations from a 2021 cybersecurity audit “remained largely unimplemented.”
The City of Hamilton and Mayor Andrea Horwath both tried to put a positive spin on the credit rating downgrading, noting that “AA+” is still the “second-highest rating possible.”
“While the cyberattack caused a technical reporting delay, it did not weaken our finances,” Horwath said.
Despite the downgrading, S&P adds that the city’s outlook is still “stable,” since “the city’s creditworthiness should remain supported by a stable economic base, liquidity buffers, and low debt levels as it continues to reconstitute its financial data.”
However, S&P warns that they could lower the rating even further over the next year “amid persistent gaps in financial disclosure.”
They add that further downgrading could also stem from higher capital spending and an increase in debt beyond their expectations.
The report notes that, after the cyberattack, data was not recoverable from backups “in several instances.”
As such, S&P says that the city has not published 2023 or 2024 audited financial statements and that there is a risk that 2025 financial data will be delayed as well.
At the same time, S&P calls Hamilton’s overall economy “resilient and diversified,” noting that the city’s large public sector presence, in addition to manufacturing, aerospace, agribusiness, food processing, and logistics.
They believe that Hamilton’s diversification “should generally insulate” the city’s employment and economy from U.S. tariffs.
Based in Hamilton, he reaches hundreds of thousands of people monthly on Facebook, Instagram, TikTok, and Twitter. He has been published in The Hamilton Spectator, Stoney Creek News, and Bay Observer. He has also been a segment host with Cable 14 Hamilton. In 2017, he received the Chancellor Full Tuition Scholarship from the University of Ottawa (BA, 2022). He has also received the Governor General’s Academic Medal. He formerly worked in a non-partisan role on Parliament Hill in Ottawa.
