Canadian Police Investigating Hydro Cyberattack

A cyber-attack on an archaic, unused IP address at Hydro One could be part of a broader hacking campaign, security experts say.

Rick Haier, chief security officer of Hydro One, said the electricity provider was contacted by the RCMP on Dec. 29, alerting them to an IP address in their system that had been targeted by hackers.

“The address in question is not an active IP address at Hydro One nor is it connected to the power system,” Haier said in a written statement. Hydro One has no reason to believe that its power system has been compromised, the company said. But attacks on individual pieces of software are not necessarily targeted at that entity or its owners, says Ira Goldstein, a senior vice president at the Herjavec Group IT security firm.

These so-called “zombie” or “bot” hacks search for weak spots in the security of anything connected to the Internet.

IP addresses, servers, computers, even WiFi-enabled baby monitors could be preyed upon, he said.

A virus is then sent to these vulnerable items, which allows them to be taken over and used for some separate, likely nefarious, purpose.

 “A lot of the attacks that are happening on the Internet are just automated programs ... where people are setting up programs for criminal (or) political means,” said Goldstein, who is not involved in the Hydro One hacking case and would not comment specifically on it.

Goldstein used the example of taking over thousands of internet-connected items and getting them all to bombard an organization’s inbox with emails in an attempt to crash its system.

The IP address targeted in the Hydro One attack was set up in the 1990s by the now-defunct Ontario Hydro, said company spokesperson Tiziana Rosa. When Ontario Hydro was split into smaller companies, the IP address migrated to Hydro One, but is not used by anyone there, Rosa added.
Goldstein said older software or hardware can be the most vulnerable to cyber-attacks, in part because they are unused.

“If you’re not monitoring them all the time, and you’re not decommissioning them when someone leaves the company, and you’re not having adequate controls on them then, that could be said to be the most dangerous thing,” he said. “The assets that you know the most about are probably the ones you’re protecting the best.”

The RCMP declined to comment on the hack or confirm the details provided by Hydro One.

“The RCMP is aware of the media reports and cannot comment any further in order to protect a potential criminal investigation,” said RCMP spokesperson Harold Pfleiderer.

On Dec. 29, the FBI and the US Department of Homeland Security issued a report outlining the tools and methods used by Russian military and civilian hackers, in an “ongoing campaign” targeting government, infrastructure, think tanks, universities, political groups, and private companies in the US.

Homeland Security shared that report with “foreign government partners, including in the Canadian government,” on Dec. 29, said agency spokesperson Scott McConnell.

Russian hackers have “conducted damaging and/or disruptive cyber-attacks, including attacks on critical infrastructure networks” outside of the US as well, the report says.

The report includes a list of “signatures” used by Russian hackers and indicators that a network has been compromised. In some cases, Russian hackers used fake online identities to misdirect victims as to the source of cyber-attacks, say the FBI and Homeland Security.

Cyber attackers conduct so-called “spear phishing” scams, in which a victim is sent an email, purportedly from someone they know, containing a link that exposes them to a hack, says the report. Hackers may also try to send commands to a browser, database or other system, effectively taking control of it, the report says. They may try to insert code into a web application to give themselves unauthorised access. Or they can take advantage of existing vulnerabilities in poorly configured servers and access the information hosted on them.

The Russian government did not respond to requests for comment.

The Star:                  Canadian Companies Vulnerable To Cyber-Attacks:

 

« Robots Will Take Our Jobs – But That's Good.
Cyber Criminals Target African Banks »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

PhishLine

PhishLine

PhishLine helps Information Security Professionals meet and overcome the increasing challenges associated with social engineering and phishing.

ABL Cyber Academy

ABL Cyber Academy

ABL provide certified training courses in the field of cyber security and IT project management.

Jiran Security

Jiran Security

Jiran Security provides data and application security solution over email, mobile device and endpoints.

Intrasoft International

Intrasoft International

Intrasoft International is a leading European IT Solutions and Services Group offering a full range of IT services including Information Security.

IBA Security

IBA Security

IBA Security is a center of competence consolidating the cybersecurity expertise of the IBA Group.

Zen360Consult

Zen360Consult

Zen360Consult provides Advisory and Training services in the field of Cyber Resilience, which includes Cyber Security /ISMS and Business Continuity.

Joint Accreditation System of Australia and New Zealand (JASANZ)

Joint Accreditation System of Australia and New Zealand (JASANZ)

JASANZ is the joint national accreditation body for Australia and New Zealand. The directory of members provides details of organisations offering certification services for ISO 27001.

Recovery Point Systems

Recovery Point Systems

Recovery Point is a leading national provider of IT secure and compliant infrastructure and business resilience services.

Cord3

Cord3

Cord3 delivers data protection, even from trusted administrators – or hackers posing as administrators – with high privilege.

Kordia

Kordia

Kordia is a leading provider of mission-critical technology solutions throughout Australasia. We have the most comprehensive cyber security offering in New Zealand.

Information Services Group (ISG)

Information Services Group (ISG)

As a leading global research and advisory firm, ISG partners with our clients to determine a future vision, lead rapid change and realize the value of your digital investments at scale.

CYBRI

CYBRI

CYBRI is a cybersecurity company helping businesses detect and remediate mission-critical vulnerabilities before they get exploited by hackers.

Fescaro

Fescaro

FESCARO is a trusted cybersecurity partner for global automakers and their partners, helping them transition to software-defined vehicles (SDVs) with tailored automotive software solutions.

Knowit

Knowit

Knowit support customers in the digital transformation, simplify people’s everyday lives and create secure and innovative solutions enabling a sustainable future.

Algoritha

Algoritha

Algoritha is a pioneering entity in the realm of security and forensic services.

Cyber Husky

Cyber Husky

Cyber Husky is an agile technology company that specializes in cloud solutions, cybersecurity, and managed IT services.