Hydro-Québec has kept its online customer accounts shut for more than two days after detecting unauthorized login attempts amid a global wave of cyber threats being described as “Black October.”
The utility’s Customer Space, which allows Quebecers to pay electricity bills, track consumption and manage their accounts, has been offline since Wednesday morning. It is now expected to remain unavailable until Monday, the utility told The Gazette.
“These are unusual and unauthorized login attempts,” a Hydro-Québec spokesperson said Friday, explaining the service had been shut down as a precaution. The spokesperson said the utility’s systems had not been compromised.
It is not the first time the Crown corporation, which serves more than 4 million customers, has faced such disruption. In April 2023, a cyberattack claimed by a pro-Russian hacker group knocked its website and outage map offline.
But this week’s incident comes amid a much wider cybersecurity crisis, as advances in artificial intelligence accelerate the discovery and exploitation of security weaknesses. Governments and major companies have scrambled to protect their systems. Even Japan’s prime minister, Sanae Takaichi, was pressing website operators to install emergency fixes.
The centre of the latest alarm revolves around two flaws in PHP, a programming language used by about 70 per cent of websites, according industry estimates. Discovered by researchers using advanced AI models, the vulnerabilities, dubbed PHP2Shell, could allow hackers to take control of vulnerable web servers without a password.
Hydro-Québec said its shutdown was unrelated to PHP2Shell.