Canada's Drug Agency

Summary

A cybersecurity incident occurred when an external party accessed an application within the organization's IT systems, detected via triggered alarms. Immediate countermeasures were taken, including decommissioning the affected application and engaging third-party experts for containment, remediation, and forensic analysis. The investigation found no evidence that files were accessed or extracted. Following this incident, two additional unsuccessful breach attempts were thwarted by existing security controls. The entity maintains safeguards such as encryption, firewalls, authentication protocols, and access controls to protect confidential and personal information, excluding health data. A recent NIST assessment had identified vulnerabilities, with recommendations currently being prioritized for implementation.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In mid-March 2024, Canada’s Drug Agency (CDA-AMC) detected a cybersecurity incident after an alarm signaled unauthorized access to an application within its IT systems. The organization promptly initiated countermeasures to halt further unauthorized activity, including decommissioning the compromised application. Third-party cybersecurity experts were engaged to assist with containment, remediation, and a forensic investigation to determine the incident’s cause and scope. The forensic analysis concluded there was no evidence that files within the accessed application had been viewed, copied, or extracted by the threat actor. Following this breach, CDA-AMC faced two additional attempts to infiltrate its IT infrastructure, both of which were thwarted by existing security controls. The organization emphasized that its systems do not store personal health information, and no unauthorized access to confidential or personal data was confirmed.

CDA-AMC cited pre-existing security measures designed to protect information, including encryption, firewalls, authentication protocols, access controls, and physical safeguards for office premises. Regular reviews of policies and procedures aim to align with evolving best practices. Prior to the incident, the agency had completed a National Institute of Standards and Technology (NIST) Assessment to identify IT system vulnerabilities. Implementation of the assessment’s recommendations was underway at the time of the breach and remains a priority for the organization. The incident did not disrupt CDA-AMC’s operational continuity, and no systemic weaknesses were publicly attributed as contributing factors.

Sources

Sources available to members: 1 source.