Canada’s Parliament Suffers Data Breach

Uploaded on 2025-08-17 in NEWS-Cybersecurity News, GOVERNMENT-National, FREE TO VIEW

Canada's cyber security agency are investigating a significant data breach at the national parliament caused by an unknown threat acto targeting employee information.

The Canadian House of Commons has informed employees of an information breach. and nd the Commons said that a malicious hacker was able to exploit a knoen Microsoft vulnerability to get access to a database that contains data used to manage computers and mobile devices.

The unknown attackers has used an exloit known as CVE-2025-53770 to breach numereous other organisations, including the US National Nuclear Security Administration, the US Department of Education, Florida's Department of Revenue, the Rhode Island General Assembly,as weel government networks in Europe and the Middle East.

The CVE-2025-53786 exploit is high-severity Microsoft Exchange flaw, which allows attackers to move laterally in Microsoft cloud environments, one so serious that the US Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive.

Some of the information obtained by the hacker is not available to the Canadian public, including employees' names, job titles, office locations and email addresses, as well as information regarding their House of Commons-managed computers and mobile devices. At present, there is s no concrete information on how many employees have been affected by the breach, although the House of Commons is carrying out an investigation. A recent email to staff warned them to be on the lookout for scammers using the stolen data for phishing attempts.

Canada's Communications Security Establishment (CSE) said it is aware of the incident and is working with the House of Commons to provide support, but could not confirm who was behind the attack.

The CSE defines a threat actor as a group or individual that aims "with malicious intent" to "gain unauthorised access to or otherwise affect victims' data, devices, systems and networks." A recent threat report from the CSE found that adversarial nations, including the People's Republic of China (PRC), Russia and Iran, are increasingly behind cyber threats to Canada. But the agency said it's too early to tell who, or what, was behind this breach.

"Attribution of a cyber incident is difficult. Investigating cyber threat activity takes resources and time, and there are many considerations involved in the process of attributing malicious cyber activity," said the CSE in a statement. It calls on employees and members of the House of Commons to be especially vigilant as information accessed during the breach could be used in scams, or to target and impersonate parliamentarians.

The House of Commons said it was working with national security partners to investigate the matter, but would not disclose information, including how many employees are affected, citing the ongoing probe.

Image: Midjourney

You Might Also Read:

Germany’s Christian Democratic Party Attacked:

If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.