Cybersecurity Solutions for Canadian Mining Industry

Cyber threats facing Canadian mining and resource extraction companies

• The financial impact of a production stoppage at a large Canadian mining operation makes ransomware an extremely high-leverage attack.
• A mid-tier gold producer operating at 500,000 ounces per year loses roughly $1.4 million in production value per day at current gold prices if the operation halts.
• An oil sands operation running at 200,000 barrels per day loses about $15 million in daily gross revenue at $75 per barrel.
• Ransomware groups have explicitly targeted industrial operators for this reason, the cost of paying the ransom is often a fraction of the cost of extended downtime, creating a rational economic basis for payment that threat actors understand.
• The CCCS 2023 National Cyber Threat Assessment specifically identified critical infrastructure including energy and mining as priority targets for ransomware actors seeking high ransom payments.
• Commodity trading data and market-sensitive information are high-value targets for financially motivated attackers and foreign state actors.
• A mining company's production forecasts, reserve estimates, hedging positions, and acquisition pipeline are material non-public information under Canadian securities law.
• An attacker who extracts this data before a public announcement can profit through securities trading or sell the information to competitors or foreign state-owned enterprises.
• Canadian mining companies with significant offshore operations or joint ventures with foreign partners in jurisdictions of concern are specifically at risk from state-sponsored economic espionage.
• CSE has assessed in its Cyber Threat Bulletins that state actors target Canadian resource extraction companies to gain economic intelligence and competitive advantage for state-owned enterprises in the same sectors.
• Operational technology (OT) and industrial control systems at mine sites present a fundamentally different attack surface from corporate IT networks.
• Conveyor belt controls, ventilation systems, haul truck automation, ore processing SCADA, and environmental monitoring systems are often running on legacy operating systems, Windows XP and Windows 7 remain common in mine control rooms, and were designed for reliability and availability rather than security.
• These systems are increasingly connected to corporate IT networks for remote monitoring and optimization, creating a pathway from a phishing email in the corporate office to a manipulation of process control systems at a mine site thousands of kilometres away.
• The CCCS has issued advisories specifically warning that OT environments in Canadian critical infrastructure sectors lack the network segmentation, monitoring, and patch management practices needed to withstand targeted attacks.
• Remote site connectivity creates unique attack surface in Canadian mining.
• Operations in northern Ontario, the oil sands, British Columbia's interior, and northern Quebec connect to corporate networks via satellite, microwave links, or leased WAN circuits.
• These links are often the only connectivity available, making them single points of failure, and their management is often outsourced to telecommunications contractors whose own security posture is unverified.
• Supply chain attacks targeting mining-specific software, fleet management platforms like Modular Mining, ore tracking systems, safety management applications, and time-and-attendance systems used at remote sites, allow attackers to reach mine operators through trusted software update channels rather than direct network compromise.
• The 3CX supply chain attack in 2023 shown that even software with valid digital signatures can be compromised by a sophisticated threat actor.

Four obligations beyond standard IT security