Insights Header image
Insights Header image
Insights Header image

Urgent Cybersecurity Alert Regarding Apache Log4j

December 13, 2021 Privacy and Cybersecurity Bulletin 1 read

Canada’s Minister of National Defence has issued a statement regarding a recently identified critical vulnerability in the Apache Log4j logging product. The threat has potential for exploitation by bad actors for use in cybersecurity attacks, including against sensitive information assets. Open-source reporting indicates that the critical vulnerability is actively being scanned for and exploited.

It is being reported that various Canadian public agencies are temporarily taking down online services as a preventative measure, including the CRA, Metrolinx and thousands of government websites in Quebec.

The Canadian Centre for Cybersecurity has released technical guidance about the issue and has called on all Canadian organizations to immediately follow recommended steps to protect themselves from the vulnerability. The suggested steps include:

  1. internally reviewing all potentially impacted applications;
  2. if possible, upgrading to Apache Log4j version 2.15, which addresses the vulnerability
  3. if upgrading is not immediately possible, applying workarounds suggested by Apache; and
  4. reviewing logs for signs of compromise.

Canada’s Minister of National Defence also directs organizations that depend on third-party service providers to engage them immediately to inquire about the actions they are taking.

If your organization uses Apache Log4j, please ensure that you are taking necessary steps to address the vulnerability noted above, including following the steps recommended by the Minister of National Defence and the Canadian Centre for Cybersecurity.

If you believe that your information systems have been exploited, we recommend that you contact your legal counsel immediately. Our team of privacy and cybersecurity lawyers at McMillan LLP are ready to assist to the extent you require any support.

by Mitch Koczerginski and Lyndsay Wasser

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2021

Insights (5 Posts)View More

Featured Insight

Investor Relations Activities Require Clear and Conspicuous Disclosure

BC Notice 51-703 emphasizes that investor relations activities must be “clearly and conspicuously” disclosed pursuant to Section 52(2) of the Securities Act.

Read More
May 22, 2024
Featured Insight

Unpacking Ontario’s Proposed Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024

Unpacking Ontario's Bill 194: Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024. Key changes & compliance strategies detailed.

Read More
May 17, 2024
Featured Insight

Navigating International Student Worker Restrictions: Post-Expiry Guidelines for Employers

On April 30, 2024, Canada’s temporary waiver allowing international students to exceed 20 hours of work per week expired.

Read More
May 14, 2024
Featured Insight

Understanding the Consumer-Driven Banking Framework: Key Insights from the Budget Implementation Act, 2024, No.1

On April 30, the federal government introduced the Budget Implementation Act, 2024, No. 1, which provides the legislative framework for open banking in Canada.

Read More
May 13, 2024
Featured Insight

Legal Risk Assessments – An Essential Risk Management Tool

The best way to address the legal issues that arise in any business is to focus on their identification and resolution before they become legal problems.

Read More
May 9, 2024