Canadian Cyber News Rewire - 14/03/26
Wiring you into the cyber news relevant to Canada the week ending March 14
The Weekly New Rewire is a survey of cyber or adjacent news stories that I read this past week (or recently). Please leave a comment if you think I missed anything.
Editor Notes:
Go sign Tanya Janca’s Secure-Coding Petition! (Article on this coming soon)
Canadian News
Telus Digital confirms breach after hacker claims 1 petabyte data theft
A PETABYTE of data. Telus Digital confirms one of the largest data thefts in history. ShinyHunters have claimed resonsibility. This is a massive mess up by Telus Digital to allow this much data to be exfiltrated. While Telus cannot be blamed for ShinyHunters getting access via a supply chain attack, but there should have been controls and monitoring to prevent this much theft to occur.
Supreme Court of Canada hearing in Facebook v Privacy Commissioner is on March 19
Supreme Court case concerning whether Facebook breached PIPEDA related to the Cambridge Analytica scandal.
Canada and global partners advance 6G security and resilience at Mobile World Congress
Western countries learned after what happened with 5G and China and are much more active in developing future protocols.
This has a lot of potential implications. The EU is potentially even more concerned about digital sovereignty than Canada, so improving Canada-EU digital trade would be great to grow Canadian cyber industry in the EU.
Bell teams up with Coveo to modernize digital services for Ottawa, provinces
Cybersecurity and Enterprise AI: Silicon Valley Canadian Technology Accelerator
Trade Commissioner and a group of Canadian cyber firms are headed to RSAC
Government of Canada says jk, nevermind, TikTok is cool now as long as Americans are harvesting and exploiting our data instead of China.
Loblaw says some customers affected by data breach
“Low-level data breach” is an interesting phrasing here. A “criminal third-party” accessed names, phone numbers, and emails. Sounds like they’re trying to downplay this breach.
Canada advances Defence Industrial Strategy to strengthen security, sovereignty and prosperity
Largely for innovation overall, but part of this does go to cyber and ICT.
Projects supporting the growth of Atlantic Canada’s artificial intelligence ecosystem
This is the list of projects/businesses through the government’s $8.5 million investment into AI, which includes a handful of cybersecurity
Satellites are Canada’s next sovereignty frontier as global ‘race’ heats up
I have been saying for a while now that Canada has a really strong domestic space defence industry.
Privacy Commissioner of Canada tables in Parliament Special Report on ArriveCAN app investigation
The special report can be read here. The investigation was based on a complaint that the contractor did not have appropriate security clearances. OPC found the complaint is “not well-founded,” however they did find some deficiencies and provided recommendations for improvements.
Turning intent into action: inside CAFCYBERCOM’s Command Evolution Team
Article from CAFCYBERCOM Public Affairs Officer on the standing up of CAFCYBERCOM.
Pictures from CAFCYBERCOM’s Military Cyber Security Operations Course Philippines 2026
Xanadu in talks with government over potential $390 million for domestic quantum manufacturing
This would be a big win for Canada. There’s limited quantum manufacturing in Canada right now, but it has been slowly growing over the past couple of years and is a great potential area for growth.
Government of Canada reconvenes the expert advisory group on online safety
Kind of makes you wonder why they decided to not convene it until now.
Ontario health agency vendor suffered major ransomware attack in 2025
This really highlights the major gaps in cybersecurity regulations and reporting in Canada.
Government Reintroduces Bill C-22: Canada introduces new tools for law enforcement to investigate threats and keep Canadians safe
Some news coverage:
Police will get new powers for online data in tweaked ‘lawful access’ bill
New lawful access bill would give police, CSIS more powers to track suspects online
The scope of data retention is clarified: only prescribed metadata may be retained for up to one year, excluding content, browsing history, and social media activity.
CRTC eliminates fees to make it easier to switch Internet and cellphone plans
Every so often the CRTC makes some good decisions for the consumer. Part of CRTC’s overall Consumer Protections Action Plan.
Standing Senate Committee on Social Affairs, Science and Technology
Canadian Senate studying impacts of AI in Canada
Privacy and cyber security laws are not uniform across Canada, with Quebec having the most modern/up to date laws, so there’s a lot of incongruency across the provinces.
Coalition Enters Excess Cyber Insurance Market in Canada
US-Based Coalition announces expansion into excess cyber insurance market in Canada. I’m honestly not a big fan of cyber insurance and think it can excerbate many problems.
Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) and Retail Council of Canada is a partnership I am surprised isn’t done more with other trade associations. This is an easy path for any trade association to take to specifically address the cyber needs of their sector.
Read my analysis of sovereign cloud RFI and what it tells us about the Government of Canada's direction on sovereign cloud:
Canada Cyber Threat Watch
While not all attacks are reported or receive media attention, any notable or open-source cyber attacks on Canadian organizations and any relevant cyber threat intelligence to Canada will be posted here. I only list the Canadian Centre for Cyber Security’s (CCCS) alerts here, not all advisories; follow the full feed here.
ShinyHunters Hackers Threaten 400 Firms Over Stolen Salesforce Data
ShinyHunters have seen increasing success lately. (See Telus)
Supply-chain attack using invisible code hits GitHub and other repositories
A lot of supply chain attacks are hitting Github.
Sandworm: Russia’s global infrastructure wrecking crew
Decent CTI profile on Sandworm/APT44
Global Cyber Attacks Remain Near Record Highs in February 2026 Despite Ransomware Decline
Checkpoint says Canada ranks second worldwide in ransomware. This isn’t good.
Have your business and logo featured in Canadian Cyber in Context with a sponsorship.
Research, Op-Eds, and Events
Briefing Note: Quebec’s Sovereign IT Policy
Briefing note on Quebec’s Digital Sovereignty and IT Procurement Policy by Emily Osborne @ Canadian Shield Institute
As U.S. state and Big Tech become one, we become digital serfs, and it sucks
Opinion piece by Vass Bednar, Managing Director of the Canadian Shield Institute
Sovereign by Design: Strategic Options for Canadian AI Sovereignty
Report on options to develop sovereign AI in Canada by former government bureaucrat who had a large role in the government’s policy, Jaxson Khan, and former Trudeau economic advisor Sean Mullin
Event: Rogers Cybersecure Catalyst is hosting a Defence Sector 101
Hosted by Daniel Blanc, former CAFCYBERCOM. If you are in the cyber sector and curious about defence, this is one not to miss.
Inside the Dirty, Dystopian World of AI Data Centers
There’s a massive demand for cloud and AI data centres, but there’s a major social, environmental, and health impact on humans.
Panel Discussion on Canada’s AI Strategy Consultations
“Industry experts gather in Ottawa to discuss the findings of the federal government’s recent public consultations on Canada’s national artificial intelligence (AI) strategy. This panel discussion features Erin Kelly (Advanced Symbolics Inc.), Michael Geist (University of Ottawa), and Jaxson Khan (Aperture AI). The event is hosted by the Canadian Internet Society and is moderated by Brent Arnold, the society’s chair. Katie Preiss (TELUS) provides opening remarks.”
Deception and Detection: Why Artificial Intelligence Empowers Cyber Defense over Offense
Article by Lennart Maschmeyer, easily one of the best academics doing research on cyber conflict. (Even though we disagree on a lot)
Age Verification Lobbying: Dark Money, Model Legislation & Institutional Capture
An investigation has found Meta and other social media companies behind a major push to lobby governments to shift age verification from websites to app stores.
United States News
Whistleblower claims ex-DOGE member says he took Social Security data to new job
I would not be surprised if this turned out to be true with how terrible DOGE was at security and ruining everything it touched.
An iPhone-hacking toolkit used by Russian spies likely came from U.S military contractor
Likely designed by L3Harris. L3Harris has a pretty big presence in Canada, but it is unclear if they sell exploits to Canada. I have been trying to learn just to what degree Canada purchases exploits from private sellers the past few years with nothing coming up yet, but that does not mean it is not occurring.
An L3Harris executive was sentenced to 7 years in prison for selling zero-days to Russian Operation Zero. There are some suspicions that he also sold this toolkit, which is also being used by Trickbot ransomware.
Feds take notice of iOS vulnerabilities exploited under mysterious circumstances
This is the Coruna exploit mentioned above.
Viral ‘Quittr’ Porn Addiction App Exposed the Masturbation Habits of Hundreds of Thousands of Users
From the author of this story: “these kids are making Ferrari money telling people to use their app in order to stop watching porn, but they exposed their most intimate data and then lied to me about it”
Rudd confirmed to head NSA, Cyber Command after near year-long vacancy
GAO report on cybersecurity regulations in the US
Iranian Hacktivists Strike Medical Device Maker Stryker in “Severe” Attack that Wiped Systems
Major attack on Stryker affecting global operations in US, Australia, India, Ireland.
No, it’s not ‘unnecessarily burdensome’ to control your own data
No one is believing the State department’s efforts to undermine digital sovereignty.
235,000 affected by cyberattack on largest ambulance provider in Wisconsin
A lot of critical information stolen in this attack.
Hackers may have breached FBI wiretap network via supply chain
A lot of organizations getting hit with supply chain attacks at the moment.
Exclusive: New data shows increase in FBI searches of Americans’ data last year
Not a surprise at all. This will continue and I worry it will eventually increase in targeting non-Americans.
Starbucks discloses data breach affecting hundreds of employees
Unclear how much and who are affected so far, could potentially include Canada.
United Kingdom and European Union News
Finnish intelligence warns of persistent cyber espionage from Russia, China
Cork Stryker plants hit by suspected global Iranian-linked cyberattack
Appears to be hitting global operations. This comany makes medical devices include defribulators.
Swiss e-voting pilot can’t count 2,048 ballots after USB keys fail to decrypt them
Technical errors are dooming this test in e-voting.
Reason doesn’t seem to be clear yet, but investigation is ongoing.
Iran-linked hackers claim cyberattack on Albania’s parliament email systems
German Military University Adopts British Defense Hacking Program
“London-based Common Mission Project UK has announced the launch of its Hacking for Defense academic program in Germany in partnership with the University of the Bundeswehr Munich, marking the initiative’s first deployment in continental Europe.”
Poland says foiled cyberattack on nuclear centre may have come from Iran
Hard to say how much of this is scare mongering, but Iran will be looking for any potential vulneraiblity just like Russia right now.
Understanding tradecraft is important to understanding many dynamics to international cyber conflict.
Moscow businesses struggle as Russia restricts cellphone internet services
The article tries to frame this as Russia is increasingly trying to roll back the Internet in the country so that they eventually have their own Great Firewall of China. In reality, it is more likely to do with preventing use of mobiel internet by Ukraine. I have seen some rumors of other concerns related to a coup, but nothing official yet.
Europol and international partners disrupt ‘SocksEscort’ proxy service
Paid criminal proxy service taken down: Law enforcement shuts down botnet made of tens of thousands of hacked routers
Cyberattack against former BND vice president
Former high-ranking official falls for Signal spear-phishing
Office.eu officially launches in The Hague as Europe’s fully sovereign office platform
Other News
‘Invasive’ AI-led mass surveillance in Africa violating freedoms, warn experts
Where Authoritarian and dictatorial people operate, spyware and AI-led surveillance will follow.
‘AI Is African Intelligence’: The Workers Who Train AI Are Fighting Back
Fantastic reporting here. AI is based on data, but not just any data, AI requires good data. To ensure the data that AI is trained on is good, reliable, and accurate requires a lot of labour, which can be both physically and mentally taxing.
Iran-Linked Handala Hackers Claim Major Hacks on Stryker and Verifone
Verifone has not reported a breach yet, but Stryker is already making a lot of headlines (noted above).