The day Nunavut went dark

An isolated community recovers in record time from a ransomware attack 
An aerial view of Nunavut, Canada with many houses and industrial buildings in view.

Imagine a place far up north inhabited by resourceful people who love their magnificent land. Residents are spread across 25 remote communities, many accessible only by plane or boat. The Government of Nunavut has a strong presence in the communities, and if there’s a glitch in its system, many services including courts, hospital operations, and student loans would be impacted

A graphic map of the United States and Canada in white and shades of brown. The words “Nunavut, Canada” are visible.

Nunavut is Canada’s largest, northernmost territory encompassing most of the Canadian Arctic with islands that cross into the Arctic Circle. Its lands are mostly tundra swathed with thousands of lakes and rivers, snowy mountains, and flatlands with permafrost just below the surface. During the cold months, Aurora Borealis illuminates the night sky with flowing neon colors. According to Inuit legend, the lights are spirits of the dead playing ball in the heavens.

Home to over 30,000 indigenous peoples living in small coastal settlements, Nunavut means “Our Land” in Inuktut, the language of the Inuit. Many of them jump on snowmobiles in the dead of winter and cut through subzero winds to hunt, set a trap, or fish. Despite the unforgiving weather, the people of Nunavut are strong and resourceful.

In November 2019, during an Arctic winter, ransomware attacked the Government of Nunavut’s infrastructure, taking down everything from phones to servers. Public services were wiped out in all 25 of its communities, removing the lifeline to many of the population’s needs. The government considered whether it should rebuild the old network or move forward with another system.

We saw everything go dark on all of our infrastructure. We were in shock.
Martin Joy
Director of Information and Communications Technology for the Government of Nunavut

The team we hope you never meet

Since every device would need to be rebuilt it could take up to a year to get back online. The harsh climate had to be considered. Most technicians would need to be flown in. They had less than a month to recover—an impossible amount of time—if they wanted to keep things running smoothly.

The Government of Nunavut’s IT team responded quickly with a well-coordinated strategy. They turned to the elite Microsoft Incident Response team for support. The Microsoft Incident Response team refers to itself as “the team we hope you never meet” because of the dire situations they’ve encountered. Together, they deployed a suite of upgraded security solutions while also rebuilding the infrastructure for the Nunavut territory.

We needed to follow a detailed recovery process while also providing the IT services that support schools, healthcare delivery, payroll, and smooth functioning of the Justice Department,” says Martin.

Limitations of a siloed security system outfitted with separate tools made the task challenging, but Microsoft Incident Response helped the team set up a future-forward security posture one layer at a time. A new Windows image was deployed on more than 5,000 devices, speeding up a process that would have taken months to complete.

“None of our previous tools gave us a complete view of our estate,” says Nathaniel Alexander, Manager of Network Operations for the Government of Nunavut. “Without a central monitoring solution to ingest all that disparate data, it took more work and more time to understand the threat landscape.”

Microsoft installed security solutions like Microsoft Sentinel and Microsoft Defender as part of the reconstruction of a stronger security system for Nunavut. Using AI, these solutions detect and deflect potential threats with complex conditions and signals—threats that are too difficult for humans to see. With this protection, the Nunavut team can focus on what’s most important to their government and people.

“Microsoft Incident Response supported the actions we’d taken prior to their arrival, and helped us expedite the journey ahead,” says Martin. “We’d planned a 12-month project to decommission our old Exchange servers. That was fast-tracked to a five-day project to deploy Microsoft 365 and onboard most communities, with all of them prepared for go-live.”

Up and running faster than predicted

Nine days after the attack, Microsoft Incident Response helped recreate and rebuild the Government of Nunavut’s core critical infrastructure with a full onboarding of Microsoft 365. Within six weeks, the infrastructure was fully back up and operational with all 25 communities, 800 servers, and 5,500 devices rebuilt and online.

The system now runs on a series of interoperable Microsoft security solutions augmented by a tightly coordinated security landscape. Multiple telemetry data streamed from applications at scale are quickly ingested for analysis with Azure Data Explorer. Azure Logic Apps—an integration platform as a service (iPaaS)—helps Nunavut IT automate its business-critical workflows with a highly secure connection to cloud-based and on-premises applications. Microsoft Purview Information Protection is layered on to classify and protect documents by applying labels to content.

The Government of Nunavut feels confident about its security and is proud of what they accomplished with the Microsoft Incident Response team guiding them through the process. The recovery program was also a welcome opportunity to implement several needed improvements. The approachability of Microsoft’s security solutions is an advantage Nunavut IT is grateful to have.

“Our network and systems teams are all-in about engaging and transforming,” says Martin. “With the new Microsoft Security tools, we have end-to-end visibility and the data we need to make the best decisions at the right time. It’s been transformative.”

A man stands in front of a painted mural on a wall. The mural is a colorful depiction of two indigenous peoples from Iqaluit.

Public art in Iqaluit, the capital of Nunavut. (Photo courtesy of the Government of Nunavut)

A language for future generations

Spoken by 70 percent of Nunavut’s residents, Inuktitut is the primary dialect of the Inuktut language. Inuinnaqtun, another dialect, is on UNESCO’s list of endangered languages with less than 600 in Nunavut speaking it. The Government of Nunavut collaborated with Microsoft to preserve the Inuktut language by launching these dialects with Microsoft AI. Feedback has been enthusiastic and positive since community members are learning and using Inuktut dialects every day. With Microsoft Translator, communication with long distance healthcare providers is easier and more effective, younger generations can use the app to connect better with their elders, and Microsoft Office users have the option to email and translate in the language they choose.

Together, Microsoft and the Government of Nunavut are transforming services with technology. Microsoft Teams has been deployed to many of its 5,200-plus employees and support workers, enabling a virtual connection across its immense territory. Skills training and essential services can be accessed much faster, saving time and travel costs. Windows 365 helps manage and deliver the expertise needed to improve quality of life for local communities. Government administration, infrastructure, and cybersecurity are managed more seamlessly with Windows, creating a more secure landscape.

Microsoft continues to help the Government of Nunavut provide more accessible programs and services through tech, creating valuable, lifelong educational and economic opportunities for remote communities.