Hacktivists have breached Canadian critical infrastructure systems to meddle with controls that could have led to dangerous conditions, marking the latest in a string of real-world intrusions driven by online activists rather than spies.

In a joint alert issued this week, the Canadian Centre for Cyber Security and the Royal Canadian Mounted Police said industrial control systems (ICS) had been manipulated by hacktivists – not for money, but for the thrill and headlines.

The victims included a municipal water facility where pressure values were changed, an oil and gas company whose tank gauge was tampered with, and a farm silo where drying temperatures were altered, "resulting in potentially unsafe conditions if not caught on time."

Officials stressed these weren't sophisticated, state-sponsored operations but opportunistic intrusions that caused real-world disruption ranging from false alarms to degraded service. The attackers didn't need custom malware or insider access either – just a connection and curiosity.

"While individual organizations may not be direct targets of adversaries, they may become victims of opportunity as hacktivists are increasingly exploiting internet-accessible ICS devices to gain media attention, discredit organizations, and undermine Canada's reputation," the alert said.

The advisory listed a depressingly familiar roll call of vulnerable kit: PLCs, remote terminal units, human-machine interfaces, SCADA systems, safety controllers, building management setups, and other industrial IoT gear that's notoriously fragile when left exposed. Operators were urged to take stock of what's online, lock it down behind VPNs and multi-factor authentication, and monitor it like a critical system – because it is.

The US government has previously sounded the alarm on foreign hacktivists attempting to manipulate industrial system settings. Earlier this month, a Russian group called TwoNet was duped into targeting a fake critical infrastructure organisation, which the crew later claimed to be a real-world attack.

• DEF CON hackers plug security holes in US water systems amid tsunami of threats
• Ransomware scum have put a target on the no man's land between IT and operations
• This is the FBI, open up. China's Volt Typhoon is on your network
• Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks

The Canadian Centre for Cyber Security warned that oversight remains weakest in local utilities, agriculture, and smaller manufacturers, where operational technology often runs for decades and cybersecurity spending trails behind IT. Officials urged operators to meet the country's Cyber Security Readiness Goals and to report any suspicious activity.

So far, the consequences have been mild: pressure fluctuations, false readings, and some red faces. But authorities say the same tactics could easily cause physical harm or cascading failures if repeated at scale.

It's not just industrial kit under fire in Canada. Last week, Toys R Us Canada admitted that crooks had lifted customer data, including names, addresses, phone numbers and email addresses, and dumped it online. No credit card details were taken, but the breach shows that whether it's water pumps or toy shops, Canada's digital front doors aren't as locked as they should be. ®