CSE says it hit 10 major ransomware groups and wiped stolen Canadian data
The Communications Security Establishment says it took action against 10 of the most significant ransomware groups harming Canada and its allies in 2025-26, and in one case used an active cyber operation to make a gang's infrastructure inoperable and delete stolen Canadian data advertised for sale. The disclosures are in CSE's annual report, released June 29.
The report, covering April 1, 2025, to March 31, 2026, offers a rare public view of how Canada uses offensive cyber powers against criminals, and of which foreign states its analysts track most closely.
Going after ransomware
According to the annual report, CSE took concurrent action against 10 major ransomware groups, combining authorized technical disruptions with work alongside international law enforcement. It does not name the groups.
One case stands out. A ransomware-as-a-service group linked to more than 25 incidents in Canada, across transportation, health care, pharmaceutical and business sectors, was targeted in an active cyber operation run with Five Eyes partners and police. CSE says the operation made the group's infrastructure inoperable and deleted a large amount of stolen data that had been advertised on the dark web. That group is not named either.
The Cyber Centre also sent 67 pre-ransomware notifications to 67 Canadian organizations, warning them of intrusions that typically precede encryption. In the previous year, this approach contributed to estimated savings of up to $18 million, CSE says.
Scale of the defensive work
The CSE news release says the Cyber Centre responded to more than 3,200 incidents affecting federal institutions and critical infrastructure, issued 25 alerts and 995 advisories, and sent more than 97,000 notifications to 1,363 organizations through its National Cyber Threat Notification System. CSE also conducted 1,772 supply chain risk assessments.
The minister of national defence issued 13 ministerial authorizations, four of them for foreign cyber operations. The report gives examples beyond ransomware: a defensive operation that disrupted a threat actor's infrastructure after a phishing campaign against federal institutions, active operations against fentanyl precursor brokers based outside Canada, and an operation that undermined a violent extremist group's recruitment.
The state actors
China appears most often. The report says CSE intelligence supported efforts to counter Chinese state-sponsored cyber espionage and to identify threats to elections. It includes a spotlight on Salt Typhoon, the China-linked campaign against telecommunications networks, and notes Cyber Centre bulletins on Chinese actors targeting telecoms and provincial, territorial, Indigenous and municipal governments.
On Russia, CSE says its intelligence helped identify entities used to circumvent sanctions and informed responses to Russian disinformation about the war in Ukraine, as well as threats from Russia and pro-Russian groups. It also describes an Oct. 7, 2025, claim by the hacktivist group NoName that it had accessed a Quebec municipal water treatment plant, including control of pumps and chlorine dosing.
The Cyber Centre published two bulletins on Iranian cyber threats to Canada, one tied to the Israel-Iran conflict and another to the response to U.S. and Israeli strikes in February 2026.
What the report leaves out
The report names no ransomware group, gives no detail on which Canadian victims' data was deleted and does not say whether any of the 10 disrupted groups later resumed operations. CSE says its foreign intelligence and cyber operations do not target Canadians or anyone in Canada, and that active operations require consent from the foreign affairs minister as well as approval from the defence minister.
"CSE plays a vital role in protecting Canada and Canadians, often in ways that are not visible to the public," Defence Minister David McGuinty said in the release.
What it means for organizations
The figures suggest the Cyber Centre's early warnings are one of the most practical services available to Canadian organizations. Critical infrastructure operators and other organizations can sign up for its notification services and should report incidents promptly, which feeds the intelligence behind future disruptions.
