Loading story…
Hacktivists have breached multiple internet-accessible industrial control systems (ICS) across Canada, targeting critical infrastructure sectors including water treatment, oil and gas, and agriculture. In one incident, attackers tampered with water pressure values at a water facility, leading to degraded service for the local community. Another attack involved manipulating an Automated Tank Gauge (ATG) at an oil and gas company, which triggered false alarms, while a third incident saw the manipulation of temperature and humidity controls at a grain drying silo, creating potentially unsafe conditions. Authorities report that these attacks were opportunistic rather than highly sophisticated, with the primary aim of causing disruption, generating media attention, and undermining public trust in Canadian infrastructure.
The Canadian Centre for Cyber Security and the Royal Canadian Mounted Police have issued alerts to raise awareness about the increased threat to internet-exposed ICS and to urge organizations to strengthen their security measures. While the incidents did not result in catastrophic consequences, they highlight the risks posed by insufficiently secured ICS and the growing interest of hacktivist groups in targeting such systems. The authorities emphasize the need for improved detection and mitigation strategies to prevent similar attacks in the future and to protect critical infrastructure from both opportunistic and more advanced threat actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published alert AL25-016 warning that hacktivists have repeatedly abused exposed industrial control systems in Canada. The agency said the activity appears aimed at publicity, fear, and undermining trust, and urged organizations to reduce internet exposure and strengthen remote access and monitoring.
Canadian authorities reported three recent opportunistic intrusions involving internet-accessible industrial control systems at a water treatment facility, a Canadian oil and gas company, and an agricultural grain-drying silo. The incidents led to degraded service, false alarms, and changes to industrial controls that could have created unsafe operating conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetherecord.media
Open sourcescworld.com
Open sourcecyber.gc.ca
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers have remotely tampered with operational settings in multiple Canadian critical infrastructure organizations, including a provincial water utility, an oil and gas company, and a grain drying silo. The Canadian Centre for Cyber Security issued an alert warning that attackers manipulated pressure valves at a water utility, degrading services, and triggered false alerts at an oil and gas company by altering automated tank gauges. In another incident, temperature and humidity controls were changed at a grain silo, creating potential safety risks. These attacks highlight the vulnerability of small, budget-constrained utilities to cyber threats targeting industrial control systems. The incidents underscore a growing trend of cyberattacks against critical infrastructure, with attackers exploiting remote access to manipulate physical processes and disrupt essential services. The advisory emphasizes the need for improved cybersecurity measures in the sector, as many organizations lack the resources and preparedness to defend against sophisticated threats. No specific attribution has been made public, but the attacks have raised concerns about the safety and reliability of essential services in Canada.
Jun 29, 2026
Canada’s Centre for Cyber Security has issued a warning about the increasing threat posed by hacktivists and other malicious actors targeting industrial control systems (ICS) in critical sectors such as water, oil and gas, and agriculture. The agency highlighted recent real-world incidents where attackers gained access to control systems, including a case where hackers tampered with water pressure at a Canadian water utility, impacting customer service. The alert also referenced similar attacks in the United States, such as the Cyber Av3ngers’ intrusion into a Pennsylvania water authority’s ICS and the Oldsmar, Florida incident where a hacker attempted to alter chemical levels in the water supply. These events underscore the risks associated with internet-exposed ICS devices and the potential for operational disruption. In the United Kingdom, reports obtained from the Drinking Water Inspectorate (DWI) reveal that five cyberattacks have targeted Britain’s drinking water suppliers since early 2024. While none of these incidents directly compromised the safety of the water supply, they did affect the organizations responsible for its delivery. The DWI noted that current regulations only require formal reporting of cyber incidents that disrupt essential services, potentially leaving other significant threats unreported. British officials are considering changes to the legal framework to lower the threshold for mandatory disclosure of cyber incidents affecting critical infrastructure. Both Canadian and British authorities emphasize the growing cyber risk to water utilities and the need for improved resilience and reporting standards.
Jun 29, 2026
Poland disclosed cyberattacks on five water treatment plants after intruders breached industrial control systems and, in some cases, gained the ability to change settings for pumps, alarms, and treatment equipment. Investigators said the compromises were enabled by basic security failures, including weak passwords and internet-exposed systems, and Polish authorities linked parts of the activity to Russian-aligned actors seeking to disrupt public services and probe infrastructure resilience. The incidents echo the earlier intrusion at a Florida water plant, where attackers reportedly exploited outdated software and poor password practices to gain access to operational systems. Together, the cases underscore a persistent risk across municipal water utilities: insecure remote access, exposed human-machine interfaces, aging control technology, and weak authentication can turn preventable weaknesses into threats to service continuity and public safety.
Jun 29, 2026