The ascio Weekly Review
October 27 to November 4, 2026
A Cyber Centre alert on a help desk voice phishing campaign, two actions by the Privacy Commissioner of Canada, a joint resolution on AI in health care, refrigeration cyberattacks in Europe, the Binance theft and a criminal market for stolen AI model access.
October 28, 2026
Phishing
Cyber Centre warns of help desk voice phishing campaign targeting Canadian organizations
The Canadian Centre for Cyber Security says an ongoing voice phishing campaign is targeting Canadian organizations, including organizations in the legal and financial sectors. Callers impersonate internal IT or help desk staff, claim that an urgent passkey migration, MFA enrolment or password change is required, and use real time relay to bypass conventional multi factor authentication. The Cyber Centre has identified related infrastructure naming Canadian organizations since January, with October activity concentrated on the legal sector.
Canadian Centre for Cyber Security
October 27, 2026
Privacy
Privacy Commissioner investigates breach of Crime Stoppers tip platform
Privacy Commissioner of Canada Philippe Dufresne has opened an investigation related to a cybersecurity incident involving tips shared with Crime Stoppers programs across Canada. The investigation is into Navigate360, the commercial organization that provides and manages the tip management platform used by Canadian Crime Stoppers chapters. It will examine the security safeguards Navigate360 had in place at the time of the breach to determine its compliance with Canada's federal private sector privacy law.
Office of the Privacy Commissioner of Canada
November 3, 2026
Lawful access
Privacy Commissioner asks Senate to amend lawful access Bill C 22
Privacy Commissioner Philippe Dufresne told the Senate's national security committee that his office has drafted several proposed changes to Bill C 22, the Lawful Access Act. The bill would give law enforcement and national security agencies such as the Canadian Security Intelligence Service more power to monitor and collect personal communications and data. His recommendations include a carve out for healthcare related data or privileged information, and integrating the principles of proportionality and necessity into the bill.
BetaKit
October 29, 2026
AI policy
Canada's privacy regulators call for responsible AI in health care and research
Canada's federal, provincial and territorial privacy commissioners and ombuds have issued a resolution calling for a responsible approach to the development, procurement and adoption of AI systems in health care and health research. They urge governments to legally require all parties that develop, procure and use AI systems in health care to establish effective AI governance and accountability frameworks. The resolution was passed at the annual meeting of federal, provincial and territorial information and privacy commissioners and ombuds, hosted in Ottawa.
Office of the Privacy Commissioner of Canada
November 4, 2026
Critical infrastructure
Refrigeration cyberattacks spread across Europe and reach France's blood service
Temperature controls were altered at three of France's national blood service sites amid a wave of cyberattacks affecting refrigeration systems across Europe. The Établissement Français du Sang says no health impacts have been identified and no losses of blood products have been reported, and describes the attack as reaching it through a third party refrigeration equipment provider. Businesses in at least 11 countries have reportedly been affected in the most recent attacks, and no group or entity has claimed responsibility.
The Record by Recorded Future
November 3, 2026
Threats
Binance says North Korean hackers ran months long campaign behind $6.3 billion theft
Binance says North Korean hackers used a months long attack involving multiple company employees to carry out its $6.3 billion theft. According to the company's investigators, the breach started in June, when an engineer downloaded malicious software to install a popular AI coding tool. The FBI and other U.S. agencies have blamed the theft on North Korea's TraderTraitor group, and a North Korean spokesperson has denied the country's role.
The Record by Recorded Future
November 3, 2026
AI security
Google report details criminal market reselling stolen access to enterprise AI models
A report by Google Threat Intelligence Group and Mandiant says cybercriminals are stealing cloud access to commercial large language models and reselling it to paying customers, a practice called LLMjacking. Google observed fraudulent charges exceeding US$100,000 in a single day, with cumulative charges at some organizations reaching US$1 million before access was revoked. The dominant initial access vector has been exposed or stolen cloud identity tokens, and underground services called LLM Mixers turn the stolen access into a subscription business.
Dark Reading
Summaries of the linked reporting and official sources. Follow each link for the full text.
