THE THREAT WIRE — LIVE
A live cybersecurity feed for Canadian municipalities — pulled from the Canadian Centre for Cyber Security, BleepingComputer, The Record, and Wordfence; refreshed hourly. Below the wire: the Ledger of public Canadian municipal cyber incidents on file.
On August 19th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with more than 6,000,000 active installations. This vulnerability can be leveraged by unauthenti…
On August 9th, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, discovered an Arbitrary File Upload vulnerability in Gravity Forms, a WordPress plugin estimated to have more than one million active installations. Th…
A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access. [...]
The group, which calls itself VantaCore, has targeted at least seven known victims, Russian cybersecurity firm F6 said in a report published this week.
Ransomware resilience requires more than backups or endpoint detection alone. Acronis outlines six capabilities MSPs should test across client environments, from reducing exposure and detecting attacks to preserving recovery points and rest…
Dropbox is warning some users that an unauthorized party accessed their accounts by exploiting a flaw in Lenovo's email verification process to register fraudulent Lenovo IDs. [...]
A California federal grand jury has indicted a Russian national for his role in a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware. [...]
International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet. [...]
Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. [...]
Aesto LLC, operating as Aesto Health, disclosed that a data breach discovered recently affects more than 9.5 million individuals. [...]
Threat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. [...]
On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations. The post 5 Million WordP…
Public Canadian municipal cyber incidents on file. Each row carries a citation. Where dollars are recorded, they are the cost of recovery publicly disclosed by the municipality — not the ransom paid.
IT team mobilised on first-hour detection (Sept 11), disconnected the network from the internet, restored services within eleven days. Counterpoint to Hamilton.
Two parallel incidents in Ontario education / public-sector union infrastructure. Recovery details limited in public reporting.
Hamilton-region school board ransomware incident, parallel municipal-adjacent infrastructure.
Municipality publicly disclosed a cyberattack; recovery details limited.
Payment systems offline; recovery costs not publicly disclosed.
Insurer denied $5M claim because MFA had not been fully rolled out. Permit applications, fire records, and traffic-signal management permanently lost. $18.5M ransom refused; not paid.
Patron and staff data exposed; services degraded for months.
Municipality reported a cyber incident requiring response.
Municipality reported a cyber incident requiring response.
Paid $290,000 in cryptocurrency on legal advice; total recovery cost reported at approximately $1.3M.
Paid approximately $75,000 in Bitcoin; total recovery costs reportedly over $1M.
The accessibility, privacy, and cyber regimes a Canadian municipal website operates under — in force, partial, or in flight. Each row is a citation away from the primary source. Status changes; verify before relying on a specific detail.
IN FORCE
ONTARIO
Fully in force; full-compliance deadline 2025-01-01 has passed
Scope. All Ontario public-sector organizations (municipalities, school boards, health authorities) and most private-sector organizations.
Why it matters. Municipal websites are required to meet WCAG 2.0 Level AA across all content the public can read. Non-compliance is a director-issued order with penalties up to $100,000 per day for organisations and $50,000 per day for individuals. Most municipalities running WordPress with off-the-shelf themes are technically non-compliant on at least the colour-contrast, focus-order, and form-label criteria.
VERIFIED 2026-05-04
IN FORCE
QUEBEC
Fully in force — final stage took effect 2024-09-22
Scope. Every organisation carrying on an enterprise in Quebec, including municipalities, public bodies, and any private-sector entity collecting personal information from Quebec residents.
Why it matters. Quebec municipalities must designate a privacy officer, perform privacy impact assessments before launching new systems, report breaches to the Commission d'accès à l'information, and honour data-portability and right-to-erasure requests. Penalties run to the higher of $25M or 4% of worldwide turnover for the most serious violations.
VERIFIED 2026-05-04
IN FORCE
FEDERAL CANADA
In force since 2014-07-01
Scope. Any organisation sending commercial electronic messages to Canadian recipients, including newsletter signups, contact-form follow-ups, and meeting-confirmation emails initiated by a public-facing form on a municipal website.
Why it matters. The newsletter on your municipality's website, and any commercial email triggered by a form submission, must satisfy CASL's consent and identification requirements. Express or implied consent must be on file, the message must identify the sender, and an unsubscribe must work in two clicks. Penalties run to $10M per violation for organisations.
VERIFIED 2026-05-04
IN FORCE
FEDERAL + PROVINCIAL
In force; MFIPPA amendments expected via Ontario Bill 194 successor
Scope. Federal PIPEDA covers private-sector commercial activity nationally. Municipalities operate under provincial regimes — MFIPPA in Ontario, the Municipal Government Act / FOIP in Alberta, the LCOM/LCAI framework in Quebec, and similar in each province. Every municipal contact form, dossier-style intake, and council-livestream chat is in scope.
Why it matters. Most municipal websites collect, store, and route personal information through plugins and shared hosting that the procurement section has never audited. The legal exposure is not theoretical — it lives in the form-handler plugin's database and the CDN that's caching the response.
VERIFIED 2026-05-04
PARTIAL
ONTARIO
Royal Assent 2024-11-25; FIPPA amendments in force; municipal MFIPPA amendments still to be proclaimed
Scope. Ontario provincial public-sector institutions under FIPPA; children's aid societies; school boards. Equivalent municipal MFIPPA amendments are signalled but not yet introduced — municipalities should plan against them.
Why it matters. For provincial bodies and school boards, privacy impact assessments, breach reporting, and AI-system disclosures are now required practice. Municipalities sit one regulation away from the same standard; bringing your website and form pipelines into the FIPPA-grade posture before MFIPPA catches up is the cheap option.
VERIFIED 2026-05-04
IN FLIGHT
FEDERAL CANADA
Reintroduced 2025-06-18 as Bill C-8; under SECU committee study
Scope. Designated operators of federally regulated critical cyber systems — telecom, finance, energy, transportation. Municipalities are not directly covered, but the standard set will cascade through procurement requirements onto suppliers and through provincial copy-cat legislation.
Why it matters. When CCSPA passes, federally regulated suppliers must hold a cybersecurity programme to a defined standard. Municipal procurement that touches federally regulated services (water utilities working with Hydro, transit interfaces, banking integrations) will be expected to align — even before Ontario or Quebec adopt municipal versions.
VERIFIED 2026-05-04
The Wire pulls four upstream feeds at request time, caches them at the edge for one hour, and surfaces items whose title or summary touches any of the Canadian-jurisdiction, municipal-government, or vector-of-attack term lists. CCCS items are surfaced even when keyword score is low; the Cyber Centre is the authoritative Canadian source.
The Ledger is a curated record of publicly-disclosed Canadian municipal cyber incidents on file at Fit For Gov. Each entry carries a primary citation. Where recovery costs are recorded, they are the figure publicly disclosed by the municipality — not the ransom demanded or paid. Entries are added as new incidents become public; corrections route to jesse@fitforgov.com with a citation.
No tracking, no analytics scripts, no third-party JavaScript on this page. Reading the wire does not put you in anyone’s funnel.
NEXT STEP
Municipal technology, principal-led. If your municipality is reading this wire and recognising the pattern, the call is fifteen minutes.
← Return to Fit For Gov