CRA loses taxpayer data to Heartbleed bug

Tax agency says 900 social insurance numbers compromised in online privacy breach

The Canada Revenue Agency says the social insurance numbers of 900 taxpayers were stolen last week by someone using the Heartbleed encryption vulnerability before the taxation agency shut down public access to its online services.

It happened over a six-hour period by someone exploiting the vulnerability in many supposedly secure websites that used an open-source encryption system.

The CRA said it will send registered letters to affected taxpayers and will not be emailing them because it doesn’t want fraudsters to use phishing schemes to further exploit the privacy breach.

“I want to express regret to Canadians for this service interruption,” CRA commissioner Andrew Treusch said. “I share the concern and dismay of those individuals whose privacy has been impacted by this malicious act.”

Other personal data and possibly businesses’ information may also have been lost.

“We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed,” Treusch said.

Taxpayers whose data was compromised will get bolstered CRA account protection and free access to credit protection services.

Canada’s Privacy Commissioner is also investigating.

Online services, including the E-file and Netfile online income tax portals, were patched and re-launched Sunday after what the CRA called a vigourous test to ensure they are safe and secure.

The CRA cut off access to those services April 8 as word spread that the Heartbleed bug had given hackers access to passwords, credit card numbers and other information at many websites.

People whose income tax filing was delayed by last week’s CRA interruption have been given until May 5 – beyond the usual April 30 filing deadline – to file returns without being penalized.

The Heartbleed vulnerability, which has existed for two years, compromised secure web browsing at some sites despite the display of a closed padlock that indicates an encrypted connection.

Just Posted

Category 3 fires to be prohibited in Southeast Fire District

The prohibition will take effect at noon on Wednesday, June 12

Editorial: We’re already ambassadors to our community

There are many ways to spend your extra time in Golden. Have… Continue reading

Data shows nine years of Tourism Golden growth

Tourism Golden has seen its ninth consecutive year of substantial growth in… Continue reading

Protecting small mammals after logging near Golden

A team of biologists are keeping an eye on small mammals in… Continue reading

Business profile: IGA celebrates 50 years of business in Golden

IGA has been providing the Town of Golden with their groceries for… Continue reading

PHOTOS: Elusive ‘ghost whale’ surfaces near Campbell River

Ecotourism operator captures images of the rare white orca

Victoria mom describes finding son ‘gone’ on first day of coroners inquest into overdose death

Resulting recommendations could change handling of youth records amidst the overdose crisis

Dash-cam video in trial of accused cop killer shows man with a gun

Footage is shown at trial of Oscar Arfmann, charged with killing Const. John Davidson of Abbotsford

Suicide confirmed in case of B.C. father who’d been missing for months

2018 disappearance sparked massive search for Ben Kilmer

Eight U.S. senators write to John Horgan over B.C. mining pollution

The dispute stems from Teck Resources’ coal mines in B.C.’s Elk Valley

Threats charge against Surrey’s Jaspal Atwal stayed

Atwal, 64, was at centre of controversy in 2018 over his attendance at prime minister’s reception in India

Anti-vaxxer Robert F. Kennedy Jr. to speak in Surrey

He’s keynote speaker at Surrey Environment and Business Awards luncheon by Surrey Board of Trade Sept. 17

Otters devour 150 trout at Kootenay hatchery

The hatchery has lost close to 150 fish in the past several months

B.C. church’s Pride flag defaced for second time in 12 days

Delta’s Ladner United Church says it will continue to fly the flag for Pride month

Most Read