Authorities investigating massive security breach at Global Affairs Canada

Canadian authorities are investigating a prolonged data security breach following the "detection of malicious cyber activity" affecting the internal network used by Global Affairs Canada staff, according to internal department emails viewed by CBC News.

The breach affects at least two internal drives, as well as emails, calendars and contacts of many staff members.

CBC News spoke to multiple sources with knowledge of the situation, including employees who have received instructions on how the breach affects their ability to work. Some were told to stop working remotely as of last Wednesday.

CBC News has also seen three internal emails sent to Global Affairs staff.

"Forensic work has also progressed to help us understand the scope of the data breach," one email said. "The work is ongoing, but early results suggest that many (Global Affairs Canada) users may have been affected."

Another email said the internal systems were vulnerable between December 20, 2023 and January 24, 2024. It informed anyone who connected remotely using a SIGNET (Secure Integrated Global Network) laptop that their information may be vulnerable.

The "compromised" system was the virtual private network (VPN) staff use to access Global Affairs's Ottawa headquarters. The VPN system was managed by Shared Services Canada, the GAC notice said.

Shared Services Canada is a federal department created in 2011 to take over the delivery of email, data centres and network services for many government departments and agencies.

According to Global Affairs, SIGNET is the department's secure computer network. One part of the network holds personal information on shared drives, including employees' personal information. Another part holds classified information.

It's not clear whether secret information was lost in the breach, which lasted longer than a month. It's also not clear who was behind the breach.

Email traffic and files on personal shared drives "may have been compromised," a GAC memo to staff said. GAC also said it's looking into whether "sensitive corporate information," such as credit cards and banking data, may have been breached.

Shared Services Canada and the Canadian Centre for Cyber Security — which is part of the Communications Security Establishment, Canada's cyber-security organization — are investigating the breach, GAC's email to staff said.

"Forensic work, including with these partners, is ongoing to help us understand the impact on our networks and any potential changes in the scope and in the time frame of the data breach," the GAC email to staff read.

The office of the Privacy Commissioner said Global Affairs Canada informed it of a data breach on Jan. 26.