Global Affairs Canada hit by 'cyber incident' same day warning about Russia was issued

GAC incident could be 'sending a message': expert Carleton's Stephanie Carvin, an expert in critical infrastructure protection, explains what's known about the GAC 'cyber incident.'

Canada’s foreign affairs department experienced a “cyber incident” last week that is still under investigation and has left the organization without access to some “internet-based services,” the federal government has confirmed.

In a statement the Office of the Chief Information Officer and Shared Services Canada said that the issue at Global Affairs Canada was detected on Jan. 19.

While it remains unclear whether there is a direct link, the breach was discovered on the same day that the Canadian Centre for Cyber Security issued a bulletin warning operators of critical infrastructure in Canada to be aware and take steps to mitigate Russian state-sponsored cyber threat activity.

The Communications Security Establishment (CSE), through Canada’s Cyber Centre, said on Jan. 19 it was aware of foreign cyber threat activities, including Russian-backed actors, targeting Canadian critical infrastructure network operators and their operational and information technology.

This urging came amid ongoing tensions between Russia and Ukraine, in which Canada is backing Ukraine. The federal government has joined other nations in calling for Russia to de-escalate and pull back the troops it has amassed at Ukrainian borders.

According to the statement issued on Monday, mitigation actions have been taken at Global Affairs Canada, and while “critical services” are still functioning, “work is underway” to restore access to the services not currently available.

The agency, which Foreign Affairs Minister Melanie Joly is responsible for, oversees a wide range of key activities impacting Canadians, from managing diplomatic relationships to providing consular services abroad.

“Cyber threats can result from system or application vulnerabilities, or from deliberate, persistent, targeted attacks by outside actors to gain access to information,” reads the government statement.

Both CSE and the Canadian Centre for Cyber Security are part of the “ongoing” investigation.

“At this time, there is no indication that any other government departments have been impacted by this incident,” Monday’s statement said.

The government has declined to offer any more specifics, including whether it is aware of the source of the breach, citing “operational reasons.”

Asked whether he thinks Russia may have been behind this “incident,” Conservative Leader Erin O’Toole said he was “very concerned.”

“There’s a track record of Russia doing this with respect to Ukraine, disrupting from a cyber basis, even disrupting their electricity grid. We need to make sure we have our systems reinforced,” he said in an interview on CTV News Channel’s Power Play.

With files from CTV News’ Christy Somos.