Thousands of CRA (Canada Revenue Agency) accounts breached following pair of cyberattacks

guest · Aug 16, 2020

Thousands of CRA accounts breached following pair of cyberattacks
Hack affected email addresses, direct deposit details and fraudulently issued CERB payments
August 15, 2020
https://www.cbc.ca/news/politics/canada-revenue-agency-cra-cyberattack-1.5688163

The federal government has revealed that the Canada Revenue Agency was recently hit by two cyberattacks, compromising thousands of accounts linked to the agency's services.

The agency confirmed on Saturday that as of Aug. 14, about 5,500 accounts had been affected by the separate attacks but that the breaches are now contained. The CRA's My Account, My Business Account and Represent a Client services were affected in the incidents.

"The CRA quickly identified the impacted accounts and disabled access to these accounts to ensure the safety and security of the taxpayer's information," CRA spokesperson Christopher Doody wrote in an email.
Click to expand...

The admission came after repeated inquiries from CBC News after CBC noticed a pattern of similar hacks occurring over the past two weeks.

Most reported that they were first alerted to the suspicious activity after receiving legitimate emails from the CRA confirming that their email addresses had been discontinued.
Attacks based on reused usernames, passwords
The incidents are a type of attack known as "credential stuffing," the Treasury Board's Office of the Chief Information Officer shared in a statement.
Click to expand...

Canada's cyber intelligence agency recommends that anyone affected by the breach update their passwords immediately and choose something they will not use for any other account.
Click to expand...

guest · Aug 16, 2020

Canada suffers cyberattack used to steal COVID-19 relief payments
August 16, 2020
https://www.bleepingcomputer.com/ne...ttack-used-to-steal-covid-19-relief-payments/

Canadian government sites used to provide access to crucial services for immigration, taxes, pension, and benefits have been breached in a coordinated attack to steal COVID-19 relief payments.

Using the "credential stuffing" technique, attackers managed to get into some 9,041 GCKey accounts of the total 12 million.

"Affected GC Key accounts were cancelled as soon as the threat was discovered and departments are contacting users whose credentials were revoked to provide instructions on how to receive a new GCKey," read the government statement.
The statement also acknowledged, approximately 5,500 CRA accounts have been targeted in the GCKey attack and in another recent “credential stuffing” attack aimed at the CRA.
Click to expand...

In our tests, BleepingComputer also didn't find any security captchas in use. This could have made it possible for bots to conduct automated credential stuffing.

Another impacted resident, Farivar Ahmadzadeh of Toronto told CTVNews how fraudsters managed to take out CA$10,000 on his behalf and redirected the funds to rogue accounts.
Whether this was an unrelated case of identity theft or facilitated via credential stuffing, the recent findings have exposed vulnerabilities in the GCKey system entrusted by Canadian federal bodies.

In the meantime, users should ensure their GCKey and CRA accounts have not been impacted and consider changing their passwords, as a safety measure. As stated in the government statement, "If you have immediate concerns, please call 1-800-O-Canada."
Click to expand...

guest · Aug 17, 2020

Cyberattacks that targeted Government of Canada online services brought under control, officials say
Thousands of accounts affected by attacks targeting the Canada Revenue Agency and GCKey
August 17, 2020
https://www.cbc.ca/news/politics/cra-gckey-cyberattack-1.5689106

Federal officials say a series of cyberattacks that compromised the personal information of thousands of Canadians and allowed hackers to fraudulently access government services has been brought under control.

As first reported by CBC News, the attacks targeted the Canada Revenue Agency (CRA) and GCKey, a secure online portal that allows Canadians to access services such as employment insurance, veterans' benefits and immigration applications.
"The [Government of Canada] has worked around the clock to reduce the threat to Canadians affected ... The credential stuffing attack on GC has ceased."

Brouillard said the affected accounts were cancelled as soon as the threat was discovered, and departments are contacting users whose credentials were compromised to provide instructions on how to receive a new GCKey.
Click to expand...

She said CRA hopes to have its online services for individuals back up and running by mid-week.

Butikofer said all the hacked accounts have been temporarily revoked, and each person impacted will receive a letter from the CRA telling them how they can confirm their identity and regain access to their account.
The RCMP has confirmed that its National Division, which investigates "sensitive, high profile cases that threaten Canada's political, economic and social integrity," is actively looking into the attacks. The Office of the Privacy Commissioner of Canada is also monitoring the situation.
Click to expand...

guest · Sep 24, 2020

1 month after cyberattack, some CRA online services remain unavailable
September 24, 2020
https://www.cbc.ca/news/business/cra-cyberattack-1.5737186?cmp=rss

More than a month after the Canada Revenue Agency took its website offline in the wake of a major cyberattack, the federal tax collection agency won't say when it expects its online services to fully return to normal.

A number of services within the CRA's online portal for individual Canadians remain unavailable, including the ability to manage direct deposit information, change an address or authorize a representative.
Links with Service Canada accounts have also been deactivated.

The CRA is "working diligently to restore access to all services as quickly as possible," spokeswoman Sylvie Branch wrote in an email.
Click to expand...

'Complex systems'
Jose Manuel Fernandez, a professor at Montreal's Polytechnique university who teaches about computer security, said it can take time to investigate cyberattacks and fix vulnerabilities.

"These systems are very complex," he said. "The industry as a whole has a terrible track record of building software that is reliable and free from bugs that can be exploited."
Click to expand...

Log in or Sign up

Thousands of CRA (Canada Revenue Agency) accounts breached following pair of cyberattacks

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Thousands of CRA (Canada Revenue Agency) accounts breached following pair of cyberattacks

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches