Canadian Cyber News Rewire - 20/06/26
Wiring you into the cyber news relevant to Canada the week ending June 20
The Canadian Cyber News Rewire is a survey of Canadian cyber and adjacent news stories from this past week (or recently). Questions or business inquiries: info@cyberincontext.ca
Editor Notes:
I have two new articles out with the Canadian Global Affairs Institute:
I have received a hefty round of feedback on my PhD thesis, so I may be a tad quiet outside the weekly Rewires.
Feature your business in Canadian Cyber in Context through sponsorship or advertising.
Canadian News
Bill C-8 receives royal assent and becomes law.
Ford government scolded agency over cyber attack. Docs show it knew a month earlier
I do not think it’s controversial to state that all levels of government in Canada do not understand cybersecurity. Canadian governments at the federal, provincial, and local levels have yet to adopt governance frameworks to ensure that cybersecurity receives adequate attention and concern.
G7 Leaders’ Call on a safer digital space for minors
Privacy destroying measures are taking the G7 by storm.
Unsurprising for Poilievre’s Conservatives to be unable to discuss reality, so they have to manufacture something to be angry about.
Canadian hacker pleads guilty to charges for cyberattack on Texas Republican website
Man claiming to be part of Anonymous pleads guilty to attacking Texas Republicans.
Canada’s spy service received judge’s OK to target malware-infected devices
CSIS has received permission to hack Canadian routers to remove botnets. It is unclear who the threat actor specifically is, but everyone seems to agree it is likely China. Canadian Press and others are citing CSIS reports in 2024, but really they should be citing CSE’s 2024-2025 report, which says: assisting the Cyber Centre in blocking cyber threat activities from botnets that had compromised thousands
of residential and small office routers, or that had exploited vulnerable edge devices” in relation to China.
Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
Additional coverage that has some good background on similar actions by the FBI.
Major compute power announcement. Bell and CoHere are partnering with a couple others for Cohere AI data centre for compute power.
In a big Uno Reverse moment, we actually have a Canadian company buying an American company for once.
N.L. health-care workers got an email promising a day off — but it was only a cybersecurity test
This is for the managers who authorized this: screw you. They thought it was a good idea to scam overworked, underpaid health care workers with the promise of a day off. Time and time again, it has been shown that phishing tests like this do not work and just waste time and money. Stop making cyber policy decisions based on whimsy that only proves that you are poorly training and overworking your people.
Ethics should be considered in conducting cybersecurity tests, expert says
This is also not just about ethics, but phishing tests like these do little to actually train people and just builds resentment and distrust.
Canadian hacker pleads guilty to charges for cyberattack on Texas Republican website
“Canadian hacker Aubrey Cottle has pleaded guilty to three charges stemming from a cyberattack linked to notorious hacktivist group Anonymous on the Texas Republican Party.”
Public servants at Canada’s cyber spy agency can now apply for early retirement incentive
From all that I hear, people enjoy working at CSE, so I wouldn’t be surprised if they don’t get as many people taking this as they would in CSIS, where everybody loathes working.
Mount Royal University responding to cyber attack, website down
Website and other systems down and they have retained external experts/consultants. Sounds a lot like a ransomware attack.
Canada now has updated cybersecurity laws, which includes amendments to the Telecommunications Act and creates the Critical Cyber Systems Protection Act. Deems certain sectors such as financial, telecommunications, energy, and transportation as essential services that will soon be required to implement a certain level of cybersecurity measures and report cybersecurity incidents.
Google says Chinese-linked hackers stole defence and AI data from US and Canadian labs for a year
“Between September 2023 and November 2025, the hackers sought information related to defense intelligence, military strategy in the Indo-Pacific, artificial intelligence, unmanned vehicles, cyber warfare programs and medical research, Google’s Threat Intelligence Group said in a report.”
This happens to be when Canada has been ramping up its engagement in the Pacific, particularly its cyber diplomacy and engagement with CAFCYBERCOM.
Minister McGuinty Advances NATO Priorities and Defence Cooperation During European Visit
This news release has a small mention of cyber related to engagement with Luxembourg: “Following his engagements in Brussels, Minister McGuinty travelled to Luxembourg, where he further advanced Canada’s defence partnerships and cooperation with Allied counterparts. During his visit, the Minister met with Claude Wiseler, President of the Chamber of Deputies, and members of the Foreign Affairs Committee. Discussions focused on expanding bilateral cooperation, including in emerging domains such as space and cyber, as well as continued collaboration within NATO.”
Ontario jail locked down for two weeks after security breach of computer servers
A potential human rights violation, as inmates at a jail were only allowed out of their cells for 30 minutes a day and collectively punished as the jail deals with a “breach of security systems.” Because the jail is incompetent and failed to protect its systems, they decided to commit human rights violations and keep all prisoners in isolation.
It’s not quite clear how specifically computing and artificical intelligence play into the complex other than they’ll likely support research related to it and integreate it into advanced materials research at the University of Montreal.
EXCLUSIVE Canadian lender TD tells some employees it will use software to monitor their work
Reuters is reporting that TD Bank doesn’t want to employ humans and wants to ensure they run their employees into the ground like machines, only gauging them based numbers and not as people.
‘Individuals’ lives could be at risk here,’ argues expert following Crime Stoppers data breach
Security incident at Crime Stoppers in the US may also have an impact on the Canadian Crime Stoppers Association as they use the same software, but not currently known if it has affected Canada or not.
Bill C-22 - An Act respecting lawful access
Bill C-22 passes third reading after Liberals adopt measures to limit debate
We should be very concerned and watch how Bill C-22 fares in the Senate. We do not know all of the amendments that the liberals adopted and do not yet know if they actually addressed any concerns. The Liberal party and government are not acting trustworthy in this process and increasingly show themselves to be incompetent when trying to develop any laws related to digital technologies.
Bill C-34 - An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act
Bill C-36 - Protecting Privacy and Consumer Data Act
Bill C-34 and C-36 is a lot. There is good in them, but that does not make up that this is surface dressing to provide liability coverage AI and passing the buck to a commission that will be limited in what it can do.
Parliamentary News & Upcoming Meetings
This section includes any House of Commons and Senate meetings that are relevant to Canadian cyber.
Parliament has begun its Summer break and is scheduled to resume sitting September 21.
Canada-Relevant News
As many issues don’t respect borders, this section is for stories that impact Canada, but may not be Canadian-sourced or focused, to differentiate from the previous section, which is 100% focused on Canada.
If AI Is Sentient Then So Is ‘Age of Empires II’
I love this. A lot of great work and articles are being written highlighting how there is nothing sentient about what AI is currently capable of and likely won’t be for some time. A Microsoft researcher built a basic neural network in Age of Empires 2, a video game from the 1990s. Similar basic computers can also be built in Minecraft. “If LLMs Have Human-Like Attributes, Then So Does Age of Empires II,” is the title of Adrian de Wynter’s paper showing his work.”
Accenture shells out $4.18B on three companies in big industrial cybersecurity push
Accenture is one of the big cybersecurity consultancies that the Canadian government uses. I feel like the big one in the three companies bought is Dragos, which is essentially THE name in operational technology cybersecurity.
International law enforcement initiate hunt on malware group SocGholish
Canada joins an international coalition to take down SocGholish, which is linked to Russian group Evil Corp.
Fox to acquire Roku in $22B deal
This is pretty major. To put this into perspective, imagine if Fox decided they were going to start selling TV sets. However, Fox is able to bypass this and just buy the software that many TV sets use and will have a bigger market share than if they attempted it themselves.
How Hackers Found a Back Door Into the American Living Room
We are only just at the beginning of threat actors attacking smart TVs.
GitHub dismissed security reports on flaws now exploited by supply-chain worm, researchers say
With how much GitHub is turning into a vector to infect people with malware, they should be taking their security a reputation a bit more seriously.
Introducing AWS Continuum: Security at machine speed
We’re now potentially seeing exactly why Amazon had an issue with Anthrophic’s rollout of Mythos and Fable 5. AWS introduces AI security testing for its cloud.
The Fable 5 Export Controls Harm US Cyber Defense
Katie Moussouris is one of the smartest people in this space and highest advise listening to anything she says, not just on Fable 5. As she and many other experts are saying, the export controls placed on Anthrophic’s Mythos and Fable is not only not sound, but harms cyber defence.
Canadian Cyber Threat Intelligence
Any relevant cyber threat intelligence to Canada will be posted here. I only list the Canadian Centre for Cyber Security’s (CCCS) alerts here, not all advisories; follow the full feed here.
FortiBleed — 75k Fortinet firewalls have admin passwords cracked
Klue OAuth breach linked to ‘Icarus’ Salesforce data theft attacks
New attack turned Microsoft 365 Copilot into 1-click data theft tool
Users cry foul after AMD stripped memory crypto from its consumer CPUs
Some particularly odd actions by AMD to quietly remove protections suggest to me there might be a flaw they do not want to admit. This could lead to a lawsuit or consumer action, as this was part of the advertised product and was removed without notice or reason, and AMD refuses to address it. Sounds like fraud to me.
Android developer verification: Building a safer ecosystem together
Google will soon begin to roll out an Android developer verification system.
Feature your business in Canadian Cyber in Context through sponsorship or advertising.
United States News
ICE Appears to Be Buying Immigrants’ Tax Identifiers from a Data Broker
They were previously denied multiple times by a Judge, but now they’re buying data from data brokers. “It looks for all the world like Trump is trying to skirt the law and a court order to fuel his mass-deportation campaign,” Senator Ron Wyden said.
US officials see Iran cyber threat persisting despite preliminary deal
Unless it is specifically negotiated, cyber will always persist. Constant contact and initiative persistence dictates that states must continue with cyber operations to receive their strategic benefit.
DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act
All countries should have laws like the Take It Down Act to target nonconsensual deepfake pornography. This is the same law that should have been used to take down X and their ongoing production of nonconsensual abuse material.
Kodak confirms data breach claimed by ShinyHunters extortion gang
ShinyHunters claims this attack and sounds like it was another Salesforce-related attack, which is a ShinyHunters favorite vector.
Nintendo confirms data stolen in WebMD subsidiary cyberattack
Nintendo of America attacked via TinyPulse, third-party service used for internal employee surveys. However, Nintendo claims no personal customer or financial data was stolen.
International Traffic in Arms Regulations (ITAR): Part 130 Changes To Reduce Reporting Burden
Some changes to ITAR rules in the US, in large part adjusting costs and thresholds based on inflation.
United Kingdom and European Union News
Cyberattack on Russian tech firm Astral disrupts business, government services for week
Estonia to quarantine emails sent from Russian .ru domain before they reach government officials
There is a good chance many others already do this, but it is not something that is usually publicly stated.
UK to ban social media access for children under 16
Banning social media for children is becoming the hot, favorite bad policy of the G7. A total recognition of their failure as governments to regulate social media.
‘It makes no sense’: 16- and 17-year-olds on UK social media ban
UK’s tone and approach to cyber defence is slowly beginning to shift to be more aggressive, which is a good thing.
EU grants Ukraine access to cybersecurity reserve for major attacks
Ukraine has received cybersecurity support from corporations and political organizations since the beginning of Russia’s invasion in 2022 and been central to Ukraine’s ability to keep winning.
Norway imposes near ban on AI in elementary school
It may be worth noting that Norway and the other Scandinavian countries tend to be world-class in primary education.
Other International News
India temporarily blocks Telegram over medica exam cheating fears
INTERPOL: cyber offenses now around 30% of recorded crime in Asia–Pacific
INTERPOL’s Asia and South Pacific Joint Operations Against Cybercrime release details related to their work combating cybercrime in the Asia-Pacific.
So, who triggered the false ‘misanthropy’ alert sent to cell phones in several states? (H/t Catalin Cimpanu)
Brazil’s national emergency alert system is down after a hacker sent an extreme-level alert.
Feature your business in Canadian Cyber in Context through sponsorship or advertising.
Media of the Week
The Beaverton: Carney bans social media for kids too dumb to figure out VPNs
Canada Buys & Innovation Watch
To keep the Canadian News Rewire focused on the latest news, this section will be phased out and made into its own featured article for paid subscribers.