Canada's cyber defence agency has issued an urgent warning about the growing threat to the nation's water systems, revealing that cyber criminals are increasingly targeting critical water infrastructure with potentially devastating consequences.
State-Sponsored Hackers Already in Systems
The Canadian Centre for Cyber Security published a new assessment on Tuesday that delivers an unequivocal message: state-backed hackers have almost certainly already gained access to networks used to operate water infrastructure. According to the report, these sophisticated actors are currently laying low to avoid detection while maintaining their presence in critical systems.
"Cyber threats to water infrastructure are growing, evolving quickly, and can affect every community in Canada," warned cyber centre head Rajiv Gupta. He emphasized that the severity of the situation should be clear to everyone, regardless of technical expertise, stating that "water systems now face a threat landscape they were never designed to withstand."
Recent Attacks and Vulnerabilities
The threat assessment comes after a recent incident where hackers successfully tampered with water pressure values at a municipal water facility, resulting in what the agency described as "degraded service" for the affected community. This real-world example demonstrates the tangible impact these cyber attacks can have on essential services.
According to cyber centre deputy head Bridget Walshe, the primary targets for these threat actors are the operational technology systems that allow utility companies and municipalities to monitor and control their water systems electronically. "There are lots of things that an engineer needs to control, for example, keeping the water pressure up or monitoring water levels," Walshe explained in an interview. "And today... many systems use computer technology to do that monitoring."
Ransomware: The Most Significant Threat
The cyber centre identifies ransomware as the most significant cyber threat to the reliable supply of water in Canada. Criminal organizations suspect that breached water management organizations will pay ransoms quickly to regain access to their networks and prevent prolonged disruption of critical operations.
The scope of the threat extends beyond just drinking water systems. The new report reveals that cyber criminals are targeting infrastructure related to flood control and wastewater management as well. This broadening of targets increases the potential impact on communities across the country.
Walshe highlighted the inherent risks of internet-connected control systems, noting that while they offer convenience and cost-effectiveness, they also create significant cyber vulnerabilities that many municipalities are unprepared to handle. "Anything that the engineer could do, like change the water pressure, if a cyber threat actor had the right access, they could do the same," she added, underscoring the grave implications of unauthorized access to these critical systems.
The agency's assessment serves as a stark reminder that Canada's essential infrastructure faces evolving digital threats that require immediate attention and enhanced security measures from utility companies and municipal governments alike.
