Statistics Canada website down as internet hit by millions of hack attempts

Several government websites, including Statistics Canada, were still down Thursday morning at the same time a coding vulnerability seen worldwide has opened the door to millions of reported hack attempts.

“We’re sorry! The website is currently unavailable. We apologize for any inconvenience,” a bulletin on Statistics Canada’s website said as of publication.

That comes after other outages including the website for the Canadian Intellectual Property Office, which handles trademark and copyright information, was also taken offline on Wednesday.

Artificial Intelligence Minister Evan Solomon said Wednesday in a social media post that websites went dark to protect government systems and Canadians’ information following guidance from the Canadian Centre for Cyber Security.

He said it is being done in response to a vulnerability identified in PHP, a widely used programming language that underwrites roughly 70 per cent of the world’s websites.

“This is a global issue, and other governments and organizations are also taking protective measures,” he said.

The British Columbia government posted Wednesday on social media that it had taken some of its webpages offline “as a precaution following a new global cybersecurity vulnerability.”

The B.C. government said teams were working to restore services as soon as possible.

PHP developers released urgent fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using AI, urging users to “update immediately.”

“Details of these flaws became public before fixes were ready, and attacks have since been reported,” said Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security speaking to Reuters.

“So companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”

As companies and governments deployed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud services firm Cloudflare NET.N.

“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in a post on X late on Wednesday.

“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.”

The FBI’s cyber division said the vulnerability could allow malicious actors to remotely execute code in the programming language, potentially compromising sensitive data and networks.

The PHP Foundation, which includes developers who work on securing the programming language, said it has released fixes for the vulnerabilities, along with instructions on how to update systems.

Governments in Europe and elsewhere took websites offline as a precaution on Wednesday while website operators scrambled to secure systems running the software.

The website of the Finnish government was only partly available Wednesday. A message to visitors said Finnish government websites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved.

The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki showed how much public and corporate systems rely on the software, and how hard it is to fix such flaws quickly once they are made public.

“It was a long day and a long night, I know for all the IT and security folks … I’ve not seen anything like this in a long, long time,” Microsoft MSFT.O CEO Satya Nadella said at a company event in Cologne, Germany, on Thursday.

He said the episode underscored the importance of building digital systems that can be maintained securely.

– with files from The Canadian Press and Reuters