THE THREAT WIRE — LIVE
A live cybersecurity feed for Canadian municipalities — pulled from the Canadian Centre for Cyber Security, BleepingComputer, The Record, and Wordfence; refreshed hourly. Below the wire: the Ledger of public Canadian municipal cyber incidents on file.
On April 22nd, 2026, we publicly disclosed a critical Arbitrary File Upload vulnerability in Breeze Cache, a WordPress plugin with an estimated 400,000 active installations. This vulnerability can be leveraged by unauthenticated attackers t…
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure you…
Modern crypto drainers don't hack wallets. They trick users into approving malicious transactions. Flare explores how the Lucifer DaaS platform scales wallet theft through phishing and automation. [...]
A virtual private network service called 'First VPN,' used in ransomware and data theft attacks, has been taken offline in a joint international law enforcement operation. [...]
GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS Code extension, compromised in last week's TanStack npm supply-chain attack. [...]
The international operation targeted a service known as First VPN, which had been marketed for years on Russian-speaking cybercrime forums as a secure way for criminals to evade law enforcement.
In a lengthy joint statement, Moscow and Beijing pledged closer cooperation on satellite internet technologies and joint work on software development and open-source initiatives — part of a broader effort to reduce reliance on Western techn…
A forensic breakdown of how an attacker turned CyberPanel's SnappyMail logging into a persistent webshell that survived every WordPress cleanup attempt. The post How a Webmail Log File Became a Root-Level Backdoor appeared first on Wordfenc…
The Ukrainian cyberpolice, working in conjunction with U.S. law enforcement, has identified an 18-year-old man from Odesa suspected of running an infostealer malware operation targeting users of an online store in California. [...]
Threat actors brute-forced VPN credentials and bypassed multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks. [...]
The Grafana data breach was caused by a single GitHub workflow token that slipped through the rotation process following the TanStack npm supply-chain attack last week. [...]
PinTheft, a recently patched Linux privilege escalation vulnerability, now has a publicly available proof-of-concept (PoC) exploit that allows local attackers to gain root privileges on Arch Linux systems. [...]
Public Canadian municipal cyber incidents on file. Each row carries a citation. Where dollars are recorded, they are the cost of recovery publicly disclosed by the municipality — not the ransom paid.
IT team mobilised on first-hour detection (Sept 11), disconnected the network from the internet, restored services within eleven days. Counterpoint to Hamilton.
Two parallel incidents in Ontario education / public-sector union infrastructure. Recovery details limited in public reporting.
Hamilton-region school board ransomware incident, parallel municipal-adjacent infrastructure.
Municipality publicly disclosed a cyberattack; recovery details limited.
Payment systems offline; recovery costs not publicly disclosed.
Insurer denied $5M claim because MFA had not been fully rolled out. Permit applications, fire records, and traffic-signal management permanently lost. $18.5M ransom refused; not paid.
Patron and staff data exposed; services degraded for months.
Municipality reported a cyber incident requiring response.
Municipality reported a cyber incident requiring response.
Paid $290,000 in cryptocurrency on legal advice; total recovery cost reported at approximately $1.3M.
Paid approximately $75,000 in Bitcoin; total recovery costs reportedly over $1M.
The accessibility, privacy, and cyber regimes a Canadian municipal website operates under — in force, partial, or in flight. Each row is a citation away from the primary source. Status changes; verify before relying on a specific detail.
IN FORCE
ONTARIO
Fully in force; full-compliance deadline 2025-01-01 has passed
Scope. All Ontario public-sector organizations (municipalities, school boards, health authorities) and most private-sector organizations.
Why it matters. Municipal websites are required to meet WCAG 2.0 Level AA across all content the public can read. Non-compliance is a director-issued order with penalties up to $100,000 per day for organisations and $50,000 per day for individuals. Most municipalities running WordPress with off-the-shelf themes are technically non-compliant on at least the colour-contrast, focus-order, and form-label criteria.
VERIFIED 2026-05-04
IN FORCE
QUEBEC
Fully in force — final stage took effect 2024-09-22
Scope. Every organisation carrying on an enterprise in Quebec, including municipalities, public bodies, and any private-sector entity collecting personal information from Quebec residents.
Why it matters. Quebec municipalities must designate a privacy officer, perform privacy impact assessments before launching new systems, report breaches to the Commission d'accès à l'information, and honour data-portability and right-to-erasure requests. Penalties run to the higher of $25M or 4% of worldwide turnover for the most serious violations.
VERIFIED 2026-05-04
IN FORCE
FEDERAL CANADA
In force since 2014-07-01
Scope. Any organisation sending commercial electronic messages to Canadian recipients, including newsletter signups, contact-form follow-ups, and meeting-confirmation emails initiated by a public-facing form on a municipal website.
Why it matters. The newsletter on your municipality's website, and any commercial email triggered by a form submission, must satisfy CASL's consent and identification requirements. Express or implied consent must be on file, the message must identify the sender, and an unsubscribe must work in two clicks. Penalties run to $10M per violation for organisations.
VERIFIED 2026-05-04
IN FORCE
FEDERAL + PROVINCIAL
In force; MFIPPA amendments expected via Ontario Bill 194 successor
Scope. Federal PIPEDA covers private-sector commercial activity nationally. Municipalities operate under provincial regimes — MFIPPA in Ontario, the Municipal Government Act / FOIP in Alberta, the LCOM/LCAI framework in Quebec, and similar in each province. Every municipal contact form, dossier-style intake, and council-livestream chat is in scope.
Why it matters. Most municipal websites collect, store, and route personal information through plugins and shared hosting that the procurement section has never audited. The legal exposure is not theoretical — it lives in the form-handler plugin's database and the CDN that's caching the response.
VERIFIED 2026-05-04
PARTIAL
ONTARIO
Royal Assent 2024-11-25; FIPPA amendments in force; municipal MFIPPA amendments still to be proclaimed
Scope. Ontario provincial public-sector institutions under FIPPA; children's aid societies; school boards. Equivalent municipal MFIPPA amendments are signalled but not yet introduced — municipalities should plan against them.
Why it matters. For provincial bodies and school boards, privacy impact assessments, breach reporting, and AI-system disclosures are now required practice. Municipalities sit one regulation away from the same standard; bringing your website and form pipelines into the FIPPA-grade posture before MFIPPA catches up is the cheap option.
VERIFIED 2026-05-04
IN FLIGHT
FEDERAL CANADA
Reintroduced 2025-06-18 as Bill C-8; under SECU committee study
Scope. Designated operators of federally regulated critical cyber systems — telecom, finance, energy, transportation. Municipalities are not directly covered, but the standard set will cascade through procurement requirements onto suppliers and through provincial copy-cat legislation.
Why it matters. When CCSPA passes, federally regulated suppliers must hold a cybersecurity programme to a defined standard. Municipal procurement that touches federally regulated services (water utilities working with Hydro, transit interfaces, banking integrations) will be expected to align — even before Ontario or Quebec adopt municipal versions.
VERIFIED 2026-05-04
The Wire pulls four upstream feeds at request time, caches them at the edge for one hour, and surfaces items whose title or summary touches any of the Canadian-jurisdiction, municipal-government, or vector-of-attack term lists. CCCS items are surfaced even when keyword score is low; the Cyber Centre is the authoritative Canadian source.
The Ledger is a curated record of publicly-disclosed Canadian municipal cyber incidents on file at Fit For Gov. Each entry carries a primary citation. Where recovery costs are recorded, they are the figure publicly disclosed by the municipality — not the ransom demanded or paid. Entries are added as new incidents become public; corrections route to jesse@fitforgov.com with a citation.
No tracking, no analytics scripts, no third-party JavaScript on this page. Reading the wire does not put you in anyone’s funnel.
NEXT STEP
Municipal technology, principal-led. If your municipality is reading this wire and recognising the pattern, the call is fifteen minutes.
← Return to Fit For Gov