THE THREAT WIRE — LIVE
A live cybersecurity feed for Canadian municipalities — pulled from the Canadian Centre for Cyber Security, BleepingComputer, The Record, and Wordfence; refreshed hourly. Below the wire: the Ledger of public Canadian municipal cyber incidents on file.
On April 22nd, 2026, we publicly disclosed a critical Arbitrary File Upload vulnerability in Breeze Cache, a WordPress plugin with an estimated 400,000 active installations. This vulnerability can be leveraged by unauthenticated attackers t…
A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. [...]
A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through Composer p…
The law enforcement agency published an advisory on Thursday about Kali365 — a Telegram-based service for cybercriminals that allows them to capture legitimate "OAuth" tokens enabling widespread access to Microsoft 365 environments.
In court documents unsealed on Thursday, the Justice Department said Jacob Butler ran KimWolf as a DDoS-for-hire service that infected over a million devices worldwide.
U.S. and Canadian authorities arrested and charged a Canadian man with operating the KimWolf distributed denial-of-service (DDoS) botnet, which infected nearly two million devices worldwide. [...]
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure you…
Modern crypto drainers don't hack wallets. They trick users into approving malicious transactions. Flare explores how the Lucifer DaaS platform scales wallet theft through phishing and automation. [...]
A forensic breakdown of how an attacker turned CyberPanel's SnappyMail logging into a persistent webshell that survived every WordPress cleanup attempt. The post How a Webmail Log File Became a Root-Level Backdoor appeared first on Wordfenc…
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure you…
On May 8, 2026, PRISM, Wordfence Threat Intelligence’s autonomous vulnerability research platform, discovered a critical Authentication Bypass vulnerability in Burst Statistics, a WordPress plugin with more than 200,000 active installations…
On March 21st, 2026, we received a submission for an Arbitrary File Read and an SQL Injection vulnerability in Avada Builder, a WordPress plugin with an estimated 1,000,000 active installations. The post 1,000,000 WordPress Sites Affected b…
Public Canadian municipal cyber incidents on file. Each row carries a citation. Where dollars are recorded, they are the cost of recovery publicly disclosed by the municipality — not the ransom paid.
IT team mobilised on first-hour detection (Sept 11), disconnected the network from the internet, restored services within eleven days. Counterpoint to Hamilton.
Two parallel incidents in Ontario education / public-sector union infrastructure. Recovery details limited in public reporting.
Hamilton-region school board ransomware incident, parallel municipal-adjacent infrastructure.
Municipality publicly disclosed a cyberattack; recovery details limited.
Payment systems offline; recovery costs not publicly disclosed.
Insurer denied $5M claim because MFA had not been fully rolled out. Permit applications, fire records, and traffic-signal management permanently lost. $18.5M ransom refused; not paid.
Patron and staff data exposed; services degraded for months.
Municipality reported a cyber incident requiring response.
Municipality reported a cyber incident requiring response.
Paid $290,000 in cryptocurrency on legal advice; total recovery cost reported at approximately $1.3M.
Paid approximately $75,000 in Bitcoin; total recovery costs reportedly over $1M.
The accessibility, privacy, and cyber regimes a Canadian municipal website operates under — in force, partial, or in flight. Each row is a citation away from the primary source. Status changes; verify before relying on a specific detail.
IN FORCE
ONTARIO
Fully in force; full-compliance deadline 2025-01-01 has passed
Scope. All Ontario public-sector organizations (municipalities, school boards, health authorities) and most private-sector organizations.
Why it matters. Municipal websites are required to meet WCAG 2.0 Level AA across all content the public can read. Non-compliance is a director-issued order with penalties up to $100,000 per day for organisations and $50,000 per day for individuals. Most municipalities running WordPress with off-the-shelf themes are technically non-compliant on at least the colour-contrast, focus-order, and form-label criteria.
VERIFIED 2026-05-04
IN FORCE
QUEBEC
Fully in force — final stage took effect 2024-09-22
Scope. Every organisation carrying on an enterprise in Quebec, including municipalities, public bodies, and any private-sector entity collecting personal information from Quebec residents.
Why it matters. Quebec municipalities must designate a privacy officer, perform privacy impact assessments before launching new systems, report breaches to the Commission d'accès à l'information, and honour data-portability and right-to-erasure requests. Penalties run to the higher of $25M or 4% of worldwide turnover for the most serious violations.
VERIFIED 2026-05-04
IN FORCE
FEDERAL CANADA
In force since 2014-07-01
Scope. Any organisation sending commercial electronic messages to Canadian recipients, including newsletter signups, contact-form follow-ups, and meeting-confirmation emails initiated by a public-facing form on a municipal website.
Why it matters. The newsletter on your municipality's website, and any commercial email triggered by a form submission, must satisfy CASL's consent and identification requirements. Express or implied consent must be on file, the message must identify the sender, and an unsubscribe must work in two clicks. Penalties run to $10M per violation for organisations.
VERIFIED 2026-05-04
IN FORCE
FEDERAL + PROVINCIAL
In force; MFIPPA amendments expected via Ontario Bill 194 successor
Scope. Federal PIPEDA covers private-sector commercial activity nationally. Municipalities operate under provincial regimes — MFIPPA in Ontario, the Municipal Government Act / FOIP in Alberta, the LCOM/LCAI framework in Quebec, and similar in each province. Every municipal contact form, dossier-style intake, and council-livestream chat is in scope.
Why it matters. Most municipal websites collect, store, and route personal information through plugins and shared hosting that the procurement section has never audited. The legal exposure is not theoretical — it lives in the form-handler plugin's database and the CDN that's caching the response.
VERIFIED 2026-05-04
PARTIAL
ONTARIO
Royal Assent 2024-11-25; FIPPA amendments in force; municipal MFIPPA amendments still to be proclaimed
Scope. Ontario provincial public-sector institutions under FIPPA; children's aid societies; school boards. Equivalent municipal MFIPPA amendments are signalled but not yet introduced — municipalities should plan against them.
Why it matters. For provincial bodies and school boards, privacy impact assessments, breach reporting, and AI-system disclosures are now required practice. Municipalities sit one regulation away from the same standard; bringing your website and form pipelines into the FIPPA-grade posture before MFIPPA catches up is the cheap option.
VERIFIED 2026-05-04
IN FLIGHT
FEDERAL CANADA
Reintroduced 2025-06-18 as Bill C-8; under SECU committee study
Scope. Designated operators of federally regulated critical cyber systems — telecom, finance, energy, transportation. Municipalities are not directly covered, but the standard set will cascade through procurement requirements onto suppliers and through provincial copy-cat legislation.
Why it matters. When CCSPA passes, federally regulated suppliers must hold a cybersecurity programme to a defined standard. Municipal procurement that touches federally regulated services (water utilities working with Hydro, transit interfaces, banking integrations) will be expected to align — even before Ontario or Quebec adopt municipal versions.
VERIFIED 2026-05-04
The Wire pulls four upstream feeds at request time, caches them at the edge for one hour, and surfaces items whose title or summary touches any of the Canadian-jurisdiction, municipal-government, or vector-of-attack term lists. CCCS items are surfaced even when keyword score is low; the Cyber Centre is the authoritative Canadian source.
The Ledger is a curated record of publicly-disclosed Canadian municipal cyber incidents on file at Fit For Gov. Each entry carries a primary citation. Where recovery costs are recorded, they are the figure publicly disclosed by the municipality — not the ransom demanded or paid. Entries are added as new incidents become public; corrections route to jesse@fitforgov.com with a citation.
No tracking, no analytics scripts, no third-party JavaScript on this page. Reading the wire does not put you in anyone’s funnel.
NEXT STEP
Municipal technology, principal-led. If your municipality is reading this wire and recognising the pattern, the call is fifteen minutes.
← Return to Fit For Gov