Russian cybercriminals managed to hack into a Quebec municipality’s water treatment plant systems and had the ability to wreak havoc on the crucial infrastructure before getting caught, according to Canada’s cyber spy agency.
In its latest annual report released Monday, the Communications Security Establishment (CSE) said that it detected over 3,200 cyber incidents affecting either federal government organizations or one of ten critical infrastructure sectors, such as energy, critical minerals and water.
In one particular case discussed in the report, the signals intelligence agency said it was advised last October that Russian hacktivist group NoName had broken into the Quebec water plant’s network and gained access to many crucial systems.
…
According to CSE, NoName claimed it had gained the “ability to covertly control pumps, chlorine dosing, pressure settings and monitoring/alerts systems.” The report does not identify the impacted Quebec municipality.
…
The annual report … points to two main state cyber adversaries: Russia and China. The report emphasizes that both countries pose a growing threat in the Canadian Arctic, where challenges posed by adversaries go “beyond traditional military and cyber threats to include economic and influence-related activities that seek to shape access, infrastructure, and decision-making in the region.”
…
Why are these systems controllable via the internet to begin with? If I was designing this, it would be accessible via LAN only, and tightly regulated VPN access.
Why hire someone locally when you can save money with random contractors that will do it just as well? /s
But how do you provide durable savings by outsourcing management if you airgap critical life systems?
/s
I’m surprised too. At my former company, to get access to the infrastructure took at minimum 3 different passwords (4 if you were coming in on the VPN) to get at anything. Even within the O&M system, different subsystems were segregated from each inherent. There was a lot of nested VLANS going on.
Made it interesting to configure new stuff, and there were regular audits to make sure you couldn’t simply telnet (or SSH or whatever other protocol) from one device to another.
And we weren’t anything near as important as a water utility.
There’s far more secure methods than what you listed, but I’m also curious how this happened as neither the article or anything it cites specifices what the actual weakness was. I would love if someone has any sources on this infrastructure. If they are accessible via the internet, why was any device with an SSH key compromised and how? It would likely be on that end and potentially any cybersecurity contractor that was used for this (I’m guessing this is a consequence of some neoliberalism as per usual).
Wait for power grid… it’s incredible as everything is connected on the internet with SCADA, some for like 20-25 years now, I’m sure China/Russia could have full control on it and shutdown everything in a few seconds.
The hydroelectric dam near my home runs with 14 employees on site, who work from 8:00 to 4:00. All control and monitoring is done remotely at an office about 300 km away.
That’s not enough time to sleep.
Because a town council wanted to get re-elected and so “streamlined” the budget for the water department to save voter tax dollars.
My town has a population of 300. There is no way they could afford full-time employees managing the water treatment system.
They have a water treatment system? With SCADA?
When I lived in a town of 300, water treatment was a building in behind the credit union where someone had to manually go, check the levels visually, top up the fluids and check a checklist. Once a year some university student came around and did a battery of tests to certify the water and the system.
None of it required an Internet connection or even a computer.
This is true? The article doesn’t even mention what municipality this was, so it’d be good to actually see where this happened as well. I’m trying to find sources on this, do you have one?
Yes, and the same is true for all public infrastructure and other sensitive technology.
But tankies keep up the illusion that remote control of Chinese tech isn’t a problem.
As an addition: In August 2025, a joint advisory of Western goverments’ intel - including Canadian Centre for Cyber Security (Cyber Centre) and the Canadian Security Intelligence Service (CSIS) - said,
Could you explain how this relates to the article about Russian-contracted actors? The source you linked doesn’t make that association beyond that both Russia and the PRC are cybersecurity concerns, and neither this article or the CSE report it references mentions any hardware used in this system and that report only stated they are concerned about PRC cyber-attacks, but not that this specific attack was in any way related to the PRC or that devices used in these systems are potentially compromised by the PRC is used in this system (the CSE report even emphasizes personal mobile devices, not the infrastructure of public services). The source you link also just talks about routers like, in general, which is a given in network security, and I’m sure that there is indeed a risk given the production of these devices (such as whether there is proof that this was on a network that used Westermo devices), but there’s no specifics that indicate something along the lines of PRC having direct remote control of devices used in this infrastructure. Given you’re also posting a known propaganda network (Postmedia Network agencies are basically tabloids), I’m curious if there’s some real sources associated with any of this.
(this is also the first time in my life that I’ve seen someone say that “tankies” are keeping up an illusion about Chinese tech as more secure, I’m curious where that’s come from as well)
Edit: okay, so it looks like they’ve been pretty active since I made this comment. I think it’s safe to say they’re bullshitting and did not actually take the time to research what they are talking about.