Authorities investigating massive security breach at Global Affairs Canada

Canadian authorities are investigating a prolonged data security breach following the «detection of malicious cyber activity» affecting the internal network used by Global Affairs Canada staff, according to internal department emails viewed by CBC News.

The breach affects at least two internal drives, as well as emails, calendars and contacts of many staff members.

CBC News spoke to multiple sources with knowledge of the situation, including employees who have received instructions on how the breach affects their ability to work. Some were told to stop working remotely as of last Wednesday.

CBC News has also seen three internal emails sent to Global Affairs staff.

«Forensic work has also progressed to help us understand the scope of the data breach,» one email said. «The work is ongoing, but early results suggest that many (Global Affairs Canada) users may have been affected.»

Another email said the internal systems were vulnerable between December 20, 2023 and January 24, 2024. It informed anyone who connected remotely using a SIGNET (Secure Integrated Global Network) laptop that their information may be vulnerable.

The «compromised» system was the virtual private network (VPN) staff use to access Global Affairs's Ottawa headquarters. The VPN system was managed by Shared Services Canada, the GAC notice said.

Shared Services Canada is a federal department created in 2011 to take over the delivery of email, data centres and network services for many government departments and agencies.

No word yet on scope of data breach

According to Global Affairs, SIGNET is the department's secure computer network. One part of the network holds personal information on shared drives, including employees' personal information. Another part holds