Cyber Breaches In The Canadian Power Utility Sector: Responding Effectively To A Crisis

On May 28, 2026, Gowling WLG hosted its annual Energy Busbar Session, including a discussion on how senior leadership can navigate cyber breaches in the Canadian power utility sector. The session was held under the Chatham House Rule, meaning that participants were free to use the information received, but neither the identity nor the affiliation of the speakers, nor that of any other participant, can be revealed. Accordingly, the reflections below represent the views taken by the authors and cannot be attributed to any of the panellists or the session participants.

We are deeply grateful to the panellists, C. Oates (Gowling WLG), J. Samra (Gowling WLG), and R. Haier (Juno Risk), our moderator I. Mondrow (Gowling WLG), and to all of the session participants for their willingness to share their experiences and insights on this crucial and timely topic. Many in the room shared profound, personal insights gained from hard-won experience.

Overview & importance

The energy sector is a primary target for cyber attacks because it controls critical infrastructure necessary for industry and daily life. Threat actors often target utility providers under the assumption that these companies are highly likely to pay ransoms to avoid prolonged operational downtime. As electricity grids, pipeline systems, and utility networks become increasingly digitized, both the risk and the potential magnitude of these attacks multiply. Furthermore, attackers can leverage the threat of energy sector disruption to gain leverage in broader negotiations with governments.¹

Energy companies must understand how to prevent, mitigate and remediate cyber incidents to safeguard resource operations and ensure uninterrupted public service delivery. Beyond operational downtime, cyber attacks can trigger significant environmental and safety hazards. In response to these heightened risks, the Ontario Energy Board (OEB) mandates that utilities implement specific cyber security frameworks and undergo regular independent cyber security assessments.²

The current threat landscape features a wide and growing spectrum of risks, including:

• Privacy breaches and the exfiltration of sensitive data.
• Internal security incidents, such as data mishandling, device misplacement, or device theft.
• Information technology (IT) and operational technology (OT) system malfunctions stemming from ransomware.
• Hybrid incidents, where an initial IT breach successfully escalates into an OT system disruption, representing one of the most dangerous operational scenarios for the sector.

Cyber attack response procedure

1. Proactive cyber attack management planning

Organizations cannot afford to develop a response strategy in the middle of a cyber crisis. Before an incident occurs, energy companies must establish a cyber attack management plan detailing a step-by-step response strategy. Senior management should consult legal counsel and external technical advisors to build this framework. A critical component of proactive planning is establishing pre-retained breach coaches, forensic investigation teams, and communication professionals who can be mobilized immediately upon detection.

2. Identify the breach and communicate early

Cyber attacks are frequently planted in an organization’s system long before they manifest as active disruptions. Once a breach materializes, its full scope, nature, and impact are typically ambiguous and may only become clear during the technical forensics phase. Despite this initial uncertainty, organizations must communicate quickly to minimize public panic and manage the narrative.

• Initial statements:

  Companies should promptly issue an initial holding statement, such as: "We are aware of the situation and are currently investigating."

• Avoid premature detail:

  Initial communications should omit unnecessary commentary. For example, issuing a premature apology for client inconvenience could later be interpreted in litigation as an admission of liability.

• Prioritize accuracy:

  Organizations must refrain from speculating before facts are verified. Premature assertions risk forcing multiple corrective press releases, which erode public trust and can misdirect investigators. All external communications should be reviewed by legal counsel and public relations professionals, with subsequent updates prioritizing accuracy over speed.

• Centralized communications:

  Senior management should designate a single internal point of contact for all external inquiries to ensure uniform messaging and prevent inadvertent admissions. Employees must be instructed to refrain from discussing the incident, as casual conversations can impact future litigation.

• Selecting a spokesperson:

  The spokesperson should be an individual capable of maintaining composure under extreme stress. This may not automatically be the CEO or a member of senior management, who may feel a high degree of personal responsibility for the breach. The crisis plan should include a clear hierarchy of alternate spokespersons in case the primary contact is unavailable.

• Communication focus:

  Cyber crisis communication is not a marketing exercise. Its goal is to maintain public safety, reassure stakeholders, and protect the foundational reputation of the organization.

3. Initial containment

In parallel with the initial public statement, organizations must act immediately to contain the breach, even while the full scope remains unknown. Containment procedures include notifying legal counsel and cyber insurance providers, identifying and isolating systemic vulnerabilities, and restricting the attacker's ongoing access to the corporate network.

4. Forensic investigation

The organization should immediately deploy its (ideally) pre-selected, pre-retained forensic team to evaluate the breach. The primary objectives during this stage are to determine the full nature and scope of the intrusion, identify what specific data was accessed or exfiltrated, and trace the source of the attack to understand how the vulnerability was exploited. Because this process is highly complex, close coordination between forensic investigators, legal counsel, and breach coaches is essential to ensure findings are properly documented, privileged where appropriate, and translated into actionable intelligence for decision-makers.

5. Report the breach

Canadian power utilities face rigorous regulatory reporting timelines across multiple jurisdictions:

• The OEB requires utilities to notify the Independent Electricity System Operator (IESO) of a cyber security incident by the end of the business day immediately following its occurrence.
• The federal Personal Information Protection and Electronic Documents Act (PIPEDA) mandates reporting to the Privacy Commissioner of any breach of personal information that creates a real risk of significant harm.
• Organizations operating across multiple provinces may also be subject to concurrent reporting regimes, such as those in British Columbia, Alberta, and Quebec.

These tight statutory deadlines reinforce the necessity of having pre-retained legal counsel and clear reporting templates. Non-compliance or inaccurate reporting can result in significant regulatory penalties. However, given the informational void that often surrounds cyber events, it is worth noting that initial reports do not need to contain complete or final answers to all questions being asked. Proper investigations take time.

6. Reinforce a culture of preparedness

Regular cyber breach management training is critical. Employees must understand their roles and responsibilities so thoroughly that they can execute the response plan instinctively without needing to review documentation during an emergency.

• Physical access:

  Because a severe cyber attack can completely disable digital platforms and corporate networks, organizations should print physical copies of the crisis plan and ensure that they are accessible across all offices and remote working environments.

• Reactive training:

  Traditional cyber training focuses on prevention, such as identifying phishing emails. The energy sector must expand this to include reactive training, utilizing regular mock breach exercises so personnel can practice executing the response plan in real time.

• Independent assessments:

  In alignment with OEB mandates, companies must conduct regular independent cyber security assessments to ensure technical tools and defence strategies remain up to date against evolving threats.³ This helps ensure that energy organizations’ cyber security tools are consistently up t date and effective.

Conclusion

Canada's power utilities occupy a critical position in national infrastructure, and their security protocols must reflect that responsibility. As the utility sector becomes more digitized and global cyber threats grow more sophisticated, the capacity to respond effectively to a breach is an operational necessity. By investing in proactive planning, establishing disciplined communication protocols, pre-retaining crisis management professionals, and maintaining a well-trained workforce, energy companies can better protect their corporate assets, operational continuity, and the public interest.

Read the original article on GowlingWLG.com

Footnotes

1. Government of Canada, National Cyber Threat Assessment 2025-2026.

2. Ontario Energy Board, Ontario Cyber Security Standard (Version 3.1) (March 27, 2024), ss. 4-6.

3. Ibid, s. 5.1.