Hackers Claimed Unauthorized Access to Critical Water Systems
Recently, Canada’s Communications Security Establishment (CSE), akin to the U.S. National Security Agency, issued an updated warning regarding the threats to the country’s water infrastructure. This revelation marks the first acknowledgment of a cyber intrusion specifically targeting operational technology systems within a municipal utility in Quebec, reportedly perpetrated by Russian hackers.
The CSE’s annual report, which was published on June 30, 2026, sheds light on the incident that transpired last year but withheld specific details about the affected municipality or the technical aspects of the breach. The agency disclosed that it became aware of the breach on October 7, 2025, following an online proclamation by a Russian hacker organization known as NoName057(16). This group boasted about successfully infiltrating a Quebec water treatment facility.
In the report, the CSE detailed that CSIRTAmericas, a multinational incident response body linked to the Organization of American States, had communicated the claims made by NoName057(16). The hackers alleged that they had gained control over crucial operational functionalities, including pumps, chlorine dosing systems, pressure settings, and the monitoring and alert systems associated with the water treatment plant.
However, the veracity of NoName’s claims remains in question, as Russian hacktivist groups have a history of making exaggerated or unfounded assertions about their capabilities and operations. Such announcements are often a strategic component of their broader information-warfare initiatives, aimed at instilling fear and uncertainty in targeted populations.
A spokesperson for the CSE, who spoke under the condition of anonymity, indicated that the agency is unable to disclose further information regarding the incident but emphasized the importance of the collaborative efforts between the CSE’s Cyber Centre, the CSIRTAmericas Network, and various international partners. Collectively, they work to identify, assess, and mitigate the cyber threats impacting critical infrastructure.
The inability of the affected utility to detect the breach independently highlights the ongoing challenges in securing operational technology (OT) systems, many of which are still not equipped with adequate cybersecurity measures. This vulnerability has raised concerns about the resilience of essential services in the face of increasing cyber threats.
Notably, NoName057(16) has been singled out in a U.S. indictment unsealed in December 2025, where it was described as a covert operation of Russian state security. The indictment named Victoria Eduardovna Dubranova, a Ukrainian national, accusing her of orchestrating cyberattacks and intruding on computer systems belonging to critical infrastructure operators across Europe and beyond. Dubranova was arrested and later extradited to the United States in 2025.
Adding to the complexity, a takedown of NoName057(16)’s operational framework was executed by European law enforcement agencies in July 2025. Yet, according to the Nordic Observatory for Digital Media and Information Disorder, this disruption was short-lived, with the group resuming activities shortly after.
The U.S. Department of State recognizes the threat posed by NoName057(16) and has offered a reward of up to $10 million for information leading to the identification or location of any group members. This hacker organization is believed to be responsible for over 1,500 distributed denial-of-service (DDoS) attacks on the websites of government entities, news agencies, military organizations, telecommunications providers, and other critical infrastructure across Ukraine and neighboring NATO countries such as Estonia, Finland, Lithuania, Norway, Poland, and Sweden.
The CSE has proactively warned the water sector about these escalating threats, issuing advisories in October 2025 concerning the dangers faced by internet-exposed industrial control systems (ICS) and operational technology systems. The subsequent month, the agency issued further guidance on potential cyber threats to water utilities more broadly, underlining the urgent need for improved cybersecurity protocols in these critical infrastructures.
In summary, the situation underscores a pressing need for vigilance and enhanced security measures against cyber threats posed by hacking groups that operate under the guise of national political motivations. As cyberattacks on critical infrastructure become more common, stakeholders in all sectors must prioritize commitment to cybersecurity in order to safeguard essential services against future intrusions.