US-Canada water commission investigating cyberattack

The organization tasked with managing the lake and river systems along the border between the U.S. and Canada for the last hundred years announced Wednesday that it experienced a cyberattack following reports that ransomware hackers claimed to have stolen reams of data.

The International Joint Commission (IJC) — guided by the 1909 Boundary Waters Treaty signed by both countries — approves projects that affect the water levels and flows across the border, investigates transboundary issues and offers solutions.

On Monday, the NoEscape ransomware gang claimed it attacked the organization — which has offices in Washington, D.C., Ottawa and Windsor — and stole 80 GB of contracts, geological files, conflict of interest forms and more.

#NoEscape has listed the International Joint Commission. #ransomware 1/3 pic.twitter.com/MCQzSCbmUS

— Brett Callow (@BrettCallow) September 11, 2023

The gang gave the IJC 10 days to respond to their demand for a ransom. The group did not say how much money it was demanding to unlock the files.

On Wednesday, an ICJ spokesperson confirmed that it was dealing with a cybersecurity issue but declined to elaborate about whether law enforcement has been contacted or if the organization was facing operational issues.

“The International Joint Commission has experienced a cyber security incident,” a spokesperson said. “The organization is taking measures to investigate and resolve the situation.”

They did not respond to requests for comment about whether a ransom would be paid.

Since emerging in May, NoEscape hackers have taken credit for attacks on Germany’s bar association and Hawaiʻi Community College as well as Australian companies, a hospital in Belgium, a manufacturing company in the US and another manufacturing company in the Netherlands.

Organizations like the International Joint Commission and others centered around managing or legislating water systems have become a battleground for cybersecurity regulation this year. State lawmakers and federal regulators are currently in court over rules passed by the Environmental Protection Agency (EPA) in March that add cybersecurity to annual state audits of public water systems.

This week, the Cybersecurity and Infrastructure Security Agency (CISA) announced that it would be offering drinking water and wastewater systems free vulnerability scanning services.

Water systems can get weekly automated scans that will provide a report on known vulnerabilities found on internet-accessible assets, week-to-week comparisons, and mitigations.

“Drinking water and wastewater systems are vital for our community’s wellbeing,” CISA said. “But they’re not immune to cyberattacks.”