Canada’s cybersecurity under attack, even the government is powerless

Article content

For the second time in three weeks, a municipality is reeling from a cyberattack.

The town of Huntsville, in Ontario’s Muskoka region, announced Monday that it is investigating a cybersecurity incident that occurred over the weekend, leading to the municipal office being closed.

Article content

The town said the investigation is being led by “cybersecurity specialists the Town has engaged” and they currently have no evidence any sensitive data, including personal information, has been compromised.

Article content

Just three months into 2024, Canada is facing a surge in cyber threats. From government agencies being forced off-line to small businesses and municipalities facing disruptions, no sector remains untouched as cyber attacks rapidly evolve, outpacing the ability of institutions and the government to keep up.

Several weeks after a ransomware attack disrupted IT systems in Hamilton and disabled several online services on Feb. 25, the city is still dealing with the fallout. No timeline has been set for when the city’s systems are expected to be fully restored.

Charles Finlay, executive director of Toronto Metropolitan University’s Rogers Cybersecure Catalyst, told The Canadian Press recently that the Hamilton attack highlights the critical need for municipalities to bolster their digital defences and the growing sophistication of cyber threats.

“It’s no longer a question of if a municipality is going to be attacked — it’s only really a question of when they’re going to be attacked,” Finlay said.

Article content

Article content

And it’s not just municipalities that are being targeted. At the federal level, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Royal Canadian Mounted Police (RCMP) and Global Affairs Canada have all been attacked in recent months.

Like the municipalities, experts say the government is not sufficiently prepared for the emerging cyber threats powered by generative AI technologies and often rely on obsolete cybersecurity technologies.

The 2023 update from The Canadian Centre for Cyber Security emphasized the threat of AI and the use of cyber tools to target democratic processes worldwide, including elections.

The report noted a significant rise in cyber threat activities targeting elections globally, from 10 per cent of all national elections in 2015 to 26 per cent in 2022. In 2024, a historic year for elections, the threat is more pressing than ever.

Last June, a report from the standing committee of national defence, responsible for examining legislation, activities and expenditures of the Department of National Defence and the Canadian Armed Forces, listed 37 recommendations to enhance Canada’s cybersecurity.

Article content

It included the establishment of a multi-stakeholder platform for collaboration on cybersecurity issues, modelled after the U.K.’s Industry 100 (i100), to improve information sharing and prevent future attacks.

Established by the National cybersecurity Centre, i100 fosters collaboration between the government and industry experts to tackle cybersecurity challenges collectively.

The report also called for significant investments in network infrastructure cybersecurity, a thorough assessment of government and third-party systems and collaboration with Five Eyes partners, the intelligence alliance that includes Australia, Canada, New Zealand, the U.S. and U.K.

Other recommendations included incentives for companies to enhance cybersecurity, a swift update to Canada’s cybersecurity strategy, ongoing engagement with critical infrastructure entities and adjustments to the CSIS Act to reflect current digital challenges.

In the interim, however, cyber attacks continue to grow.

Earlier this month, Canada’s national anti-money laundering agency, FINTRAC, was forced to take its corporate systems off-line following a cyber attack.

Article content

The precautionary measure was reportedly to protect stored information. FINTRAC confirmed that the incident did not involve its intelligence or classified systems.

The nature and extent of the cyber attack remains undisclosed and the agency is working with federal partners, including the Canadian Centre for Cyber Security, to restore and protect its systems.

That attack followed other recent incidents involving Trans-Northern Pipelines, Toronto Zoo, Toronto Public Library, the Memorial University of Newfoundland and the RCMP, which was targeted last month.

The RCMP stated that their intelligence or classified systems were not accessed and it had launched an investigation to determine the extent of the breach. They also said they are working on mitigation strategies to prevent future threats.

In January, Global Affairs Canada was attacked, leading to a data breach that limited remote access to its networks.

The department discovered “malicious cyber activity” and shut down remote access within Canada on Jan. 24, while providing workarounds for remote employees.

Article content

Global Affairs remained tight lipped about the attack, citing operational and security reasons for not sharing more details, though they did acknowledge the attack led to unauthorized access to personal information of employees.

Global Affairs Canada was also targeted in a separate cyber incident in January 2022 that affected its online services.

A 2020 cyberattack that targeted the Canada Revenue Agency and other government services, including fraudulent claims for Canada Emergency Response Benefit (CERB) and alterations to direct deposit information for 12,700 accounts, led to a lawsuit against the CRA and the Government of Canada.

In August 2022, a Federal Court certified the lawsuit as a class action case, with the plaintiff alleging that the government was “negligent in safeguarding the confidential information of Canadians, leading to widespread privacy breaches.”

Related to cyberattacks that targeted CRA accounts and other government services back in 2020, the lawsuit alleged that the government failed to adequately protect the privacy of class members by not securely maintaining confidential personal and financial information stored in multiple online government platforms.

Article content

Anthony Leoni, a partner at Rice Harbut Elliott LLP, representing plaintiffs in the class action, called the decision “an important first step in holding government defendants accountable if they fail to take reasonable steps.”

At the municipal level, Dan Mathieson, the former mayor of Stratford, Ont., told The Canadian Press that the latest incidents should be a wake-up call for everyone. Stratford was hit by a malware attack during his tenure, in April 2019. The city paid $75K in ransom, while it took two weeks to restore full service on its systems.

“It is a national security risk,” Mathieson said. “Our water systems, our wastewater systems, our hydroelectric power grid — all of this is run at local levels, but has national and international implications if there is a problem.”

Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our newsletters here.

Article content