Canada Cyber Brief: Air Canada Claim, Ontario Supply-Chain Noise, and CCCS Patch Orders
Opinion / Intel Brief — Jason LaFace, Editor, Alberta Radio
Week of September 14, 2026
Canadian cyber this week is a three-lane story: an unverified hit on the national airline, quiet name-drops in Ontario’s manufacturing and MSP supply chain, and a hard Canadian Centre for Cyber Security advisory that actually matters for every shop still running Windows and MikroTik gear.
Treat each lane differently. One is a dark-web poster. One is industry chatter without confirmation. One is a federal alert with CVEs already on CISA’s Known Exploited Vulnerabilities list.
1. Air Canada / “The Gentlemen” — claim, not confirmation
Around September 9, a ransomware crew styling itself thegentlemen listed Air Canada on a leak site and claimed about 51,409 “critical files.” The write-up tracked by Yazoul Security (claim report) is blunt: unverified dark-web claim. No published proof-of-data samples in the material reviewed. No ransom figure. No data-volume dump. A long corporate narrative that tracks with public Air Canada information — which is exactly how padded listings often look.
As of this writing: no confirmation from Air Canada. No confirmation from the Office of the Privacy Commissioner of Canada. No PIPEDA breach notice we can point to.
That does not mean “ignore it.” Flag carriers get hit, and leak sites are where the first noise often starts. It does mean journalism that prints “Air Canada breached” as fact is doing the actor’s work for free. Watch for samples, a company statement, OPC action, or the listing vanishing — the usual tells. Until then, this stays in the claim column.
2. Ontario supply chain — Settra / Teletek, Storm / Lowerys
Two Ontario-linked threads are circulating in the same week’s chatter:
Settra linked in reporting and industry talk to Teletek Structures
Storm linked to Lowerys, a Thunder Bay managed service provider
Neither firm has publicly confirmed an incident. Full stop.
Supply-chain and MSP compromises are how quiet intrusions become provincial problems — one IT shop, many downstream clients. The responsible play is the same as Air Canada: name the rumour, refuse to elevate it to a breach, and wait for the companies, insurers, or CCCS to speak. If you are a Lowerys or Teletek customer, ask your vendor in writing for assurance. Do not take Twitter for an incident report.
3. CCCS: patch what is already being exploited
This is the lane with receipts.
The Canadian Centre for Cyber Security’s Microsoft September 2026 monthly rollup (AV26-896) states that Microsoft has indicated CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, CISA added both to its Known Exploited Vulnerabilities (KEV) catalogue. CCCS urges administrators to review the links and apply updates as they become available (CCCS advisory).
Separately in the same Canadian threat picture this cycle: MikroTik RouterOS is also on the KEV list, and CCCS has flagged non-state actors targeting internet-exposed Canadian operational technology (OT) — the valves, controllers, and plant systems that do not belong on the open internet and still keep showing up there.
If your board only has bandwidth for one slide: patch the Microsoft KEV pair, harden or pull exposed MikroTik, and inventory OT that answers to the public web. Ransomware theatre on a leak site is optional reading. Actively exploited CVEs are not.
Bottom line
Air Canada / The Gentlemen: ~51k-file leak-site claim (~Sep 9). Unverified. No airline or OPC confirm.
Ontario: Settra↔Teletek Structures; Storm↔Lowerys (Thunder Bay MSP). No public confirmation from either firm.
CCCS / CISA: CVE-2026-81963 and CVE-2026-85880 exploited and in KEV; MikroTik RouterOS in KEV; non-state pressure on exposed Canadian OT.
Canada’s cyber problem is not a shortage of headlines. It is a shortage of verified ones — and a surplus of systems still unpatched after the government already told you the exploit is live.
— Jason LaFace, Editor / CEO, Alberta Radio
Sources
Yazoul: Air Canada ransomware claim by thegentlemen (Sep 2026)
— https://www.yazoul.net/intel/claim/2026-09-11-air-canada-ransomware-claim-by-thegentlemen-sep-2026/
CCCS: Microsoft security advisory – September 2026 monthly rollup (AV26-896)
