Canadian House of Commons breached through Microsoft SharePoint vulnerability
Learn More
Canada's House of Commons has been breached in a cyberattack that exploited a critical Microsoft SharePoint vulnerability, resulting in the exposure of sensitive employee information and internal device management data.
The attack occurred on Friday, August 9, 2025 and most probably targeted the CVE-2025-53770 (CVSS score 9.8) ToolShell Microsoft SharePoint Server. According to internal communications obtained by CBC News, attackers successfully compromised a database containing information used to manage computers and mobile devices within the parliamentary system.
Exposed Data includes:
- Employee names and job titles
- Office locations and email addresses
- Information regarding House of Commons-managed computers and mobile devices
- Database information used for device management systems
The number of affected individuals is not disclosed, but Canada's House of Commons employs close to 2,500 staff members who serve the Parliament's 343 elected members.
House of Commons staff and members were notified of the breach through an internal email on Monday, August 12, 2025, three days after the compromise. The notification warned employees and parliamentarians to be careful of potential fraudulent attempts to exploit the stolen information, which could be used for targeted phishing campaigns, impersonation attacks, or other social engineering schemes designed to further compromise government systems or personnel.
Olivier Duhaime, spokesperson for the House of Commons' Office of the Speaker, confirmed that the "House of Commons is working closely with its national security partners to further investigate this matter" but declined to provide additional details citing security reasons.
