Russian group hacked Quebec water treatment plant, gained access to control pumps and chlorine dosing

Canada’s Communications Security Establishment (CSE) says it detected more than 3,200 cyber incidents affecting federal organizations or critical infrastructure sectors, including water, in the last year.

In one example, CSE says it was notified last October that the Russian-linked cyber group NoName had breached the network of a Quebec municipality’s water treatment plant and had obtained access to systems that could be used to disrupt operations. CSE reports that NoName claimed it gained the ability to “covertly control pumps, chlorine dosing, pressure settings” and monitoring/alert systems.

The report does not name the specific Quebec municipality affected.

CSE says it was the first time the federal agency attributed a water-treatment breach to a Russian-backed group and identified the province where the impacted system was located. It adds that the breach was not originally detected by CSE itself; rather, CSE’s Cyber Centre was informed through the Organization of American States’ cybersecurity coordination network after NoName made a claim about the hack. CSE then worked with unnamed partners to mitigate the threat.

CSE frames such activity as part of a broader shift in cyber operations by state-backed actors—moving beyond traditional espionage toward more disruptive attacks—while also noting it views Russia and China as primary cyber adversaries targeting Canada, including in the Arctic region.