CRA loses taxpayer data to Heartbleed bug

Tax agency says 900 social insurance numbers compromised in online privacy breach

The Canada Revenue Agency says the social insurance numbers of 900 taxpayers were stolen last week by someone using the Heartbleed encryption vulnerability before the taxation agency shut down public access to its online services.

It happened over a six-hour period by someone exploiting the vulnerability in many supposedly secure websites that used an open-source encryption system.

The CRA said it will send registered letters to affected taxpayers and will not be emailing them because it doesn’t want fraudsters to use phishing schemes to further exploit the privacy breach.

“I want to express regret to Canadians for this service interruption,” CRA commissioner Andrew Treusch said. “I share the concern and dismay of those individuals whose privacy has been impacted by this malicious act.”

Other personal data and possibly businesses’ information may also have been lost.

“We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed,” Treusch said.

Taxpayers whose data was compromised will get bolstered CRA account protection and free access to credit protection services.

Canada’s Privacy Commissioner is also investigating.

Online services, including the E-file and Netfile online income tax portals, were patched and re-launched Sunday after what the CRA called a vigourous test to ensure they are safe and secure.

The CRA cut off access to those services April 8 as word spread that the Heartbleed bug had given hackers access to passwords, credit card numbers and other information at many websites.

People whose income tax filing was delayed by last week’s CRA interruption have been given until May 5 – beyond the usual April 30 filing deadline – to file returns without being penalized.

The Heartbleed vulnerability, which has existed for two years, compromised secure web browsing at some sites despite the display of a closed padlock that indicates an encrypted connection.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Over the years, Janice Blackie-Goodine’s home in Summerland has featured elaborate Halloween displays and decorations each October. (File photo)
QUIZ: How much do you really know about Halloween?

Oct. 31 is a night of frights. How much do you know about Halloween customs and traditions?

Mara Lake is one of the significant water resources across the Okanagan-Shuswap region that will fall under increasing sustainability pressure as the anticipated population growth for the region continues in this century. (File photo)
Okanagan Valley water supply sustainability reaching a critical point: Global expert

Global expert says Okanagan Basin Water Board offers sustainable path forward

Four staff members at the Okanagan Men’s Centre have tested positive for COVID-19 since Oct. 23, 2020. (Adult and Teen Challenge OMC photo)
Four positive COVID-19 cases at Okanagan Men’s Centre

Those affected are staff and have been in isolation since Oct. 23

Vince Schnabl looks at the view this October from the Gorge, west of Revelstoke. (Photo by Jon Wichett)
There’s 3 times more snow near Revelstoke than usual

According to 54 years of data from Parks Canada for Glacier National Park

Mail in ballot, provincial election 2020. (Liam Harrap/Revelstoke Review)
Mail-in-ballots coming in from Columbia River Revelstoke

In a progress report Elections BC said around 45 per cent of those issued have been returned

Physical distancing signs are a common sight in B.C. stores and businesses. THE CANADIAN PRESS
272 more COVID-19 cases for B.C., outbreak at oil sands project

Three new health care outbreaks, three declared over

Hiawatha RV Park will be demolished starting in February, to make room for a new condo development. Residents have four months to leave. (Phil McLachlan - Capital News)
‘I don’t know what to do’; Kelowna RV park resident pleas for eviction extension

Hiawatha RV Park residents have four months to leave the neighbourhood

Titled “Dutch Underground - Laren 1944,” Mineke Spencer’s parents Johanna and Albert Jan Koeslag (centre) sit with their 13 children, who ranged in age from seven (Minike) to 28. Mineke is the little girl with the big white bow in the front, left, beside sister Marie, also with a white bow. (Contributed)
Fearless allies: Shuswap woman reflects on childhood in Dutch Resistance

Mineke Spencer was three-years-old when Germany invaded her home in the Netherlands

FILE - In this Jan. 23, 1987 file photo, actor Sean Connery holds a rose in his hand as he talks about his new movie “The Name of the Rose” at a news conference in London. Scottish actor Sean Connery, considered by many to have been the best James Bond, has died aged 90, according to an announcement from his family. (AP Photo/Gerald Penny, File)
Actor Sean Connery, the ‘original’ James Bond, dies at 90

Oscar-winner was knighted by Queen Elizabeth II in 2000

Several police vehicles were seen at the Sagmoen farm on Salmon River Road in Silver Creek on Thursday night, Oct. 29, 2020. (Martha Wickett-Salmon Arm Observer)
UPDATE: One person arrested, released following police presence at Sagmoen farm

RCMP were at Silver Creek property where remains of Vernon woman were found in 2017

Vernon Council voted in favour of implementing a 500-metre buffer between all new cannabis stores in the city at its meeting Monday, Oct. 26, 2020. (Black Press files)
New cannabis shops in Vernon will need to stay 500m apart

The distancing rule won’t apply to existing stores, including the six currently in downtown core

Join Black Press Media and Do Some Good

Pay it Forward program supports local businesses in their community giving

A case of COVID-19 has been confirmed at Little Seedlings Daycare in Armstrong, located beside Highland Park Elementary School (pictured above). Interior Health confirmed the positive case was present at the daycare on Oct. 22 and 23, 2020. (Google image)
COVID-19 case reported at Armstrong daycare

IH letter says positive case was present at Little Seedlings Daycare Oct. 22 and 23

Most Read