Russian Water System Hack Tried to Flip Canada Dry

Vital Infrastructure Safety
,
Cyberwarfare / Nation-State Assaults
,
Fraud Administration & Cybercrime

Hackers Stated They Gained Entry to Pumps, Chlorine Dosing and Strain Settings

Shaun Waterman •
June 30, 2026    

Canada’s Communications Safety Institution, the Maple Leaf model of the U.S. Nationwide Safety Company, refreshed a warning to the nation’s water sector, revealing for the primary time that Russian hackers attacked operational know-how methods at a Quebec municipality utility final yr.

See Additionally: How Cyberattacks Can Flip Battery Farms Into Grid Blackouts

The spy company’s newest annual report, revealed Monday, didn’t determine the municipality, or present any technical particulars of the intrusion. It did reveal that CSE discovered in regards to the hack on Oct. 7 from a web-based declare of accountability made by NoName057(16), a Russian hacker group.

CSIRTAmericas, a multi-national incident response clearing home that is a part of the Group of American States, “relayed NoName’s declare of unauthorized entry to a Quebec municipality’s water remedy plant,” the report states. The hackers claimed that they had achieved “the power to covertly management pumps, chlorine dosing, stress settings and monitoring/alerts methods.”

The report doesn’t clarify whether or not the declare of entry by NoName is correct or not, and Russian hacktivist teams usually make unfounded claims about their operations. Such claims are an necessary a part of the information-warfare side of their campaigns (see: Google: Kremlin Expands AI-Backed Campaigns Throughout Europe, US).

A CSE spokesperson, who requested for anonymity, stated in a press release the company “can not present additional info.” The assertion touted the work of CSE’s Cyber Centre with the CSIRTAmericas Community, and different worldwide companions, saying they “work collectively to determine, assess and mitigate cyberthreats.”

The failure of the utility to independently detect the assault illustrates the issue of adequately defending OT, given the rudimentary state of safety in lots of OT operators.

NoName was recognized in a U.S. indictment unsealed in December as a “covert undertaking” of Russian state safety whose membership included many employees members of The Heart for the Examine and Community Monitoring of the Youth Atmosphere, “an info know-how group established by order of the President of Russia in October 2018.”

The indictment charged Ukrainian nationwide Victoria Eduardovna Dubranova for her function in conducting cyberattacks and laptop hacking intrusions towards important infrastructure organizations and different victims in Europe and past. She was arrested and extradited to the US in 2025 (see: US Warns of Ongoing Professional-Russia Vital Infrastructure Hacks).

A takedown of NoName infrastructure carried out by European authorities in July 2025 did not stick, based on the Nordic Observatory for Digital Media and Data Dysfunction, an unbiased non-profit monitoring cyber and knowledge warfare. The group reported that NoName ceased operations just for a number of weeks.

The U.S. Division of State gives a reward as much as $10 million for info resulting in the “identification or location” of any members of the group, which it stated had carried out greater than 1,500 distributed denial-of-service assaults on web sites of governments, information businesses, militaries, telecom suppliers and different important infrastructure in Ukraine and neighboring NATO members – together with Estonia, Finland, Lithuania, Norway, Poland and Sweden – as a part of the Russian gray zone marketing campaign towards Ukraine’s allies.

The CSE warned the water sector twice final yr: In October in regards to the threat to internet-exposed ICS and OT methods in important infrastructure. And the next month about attainable cyberthreats to water utilities extra usually.