CRA loses personal data to Heartbleed bug

The CRA is reporting that 900 SINs were stolen from their data banks before it was able to shut down public access.

  • Apr. 16, 2014 11:00 a.m.

by Jeff Nagel

Black Press

The Canada Revenue Agency says the social insurance numbers of 900 taxpayers were stolen last week by someone using the Heartbleed encryption vulnerability before the taxation agency shut down public access to its online services.

It happened over a six-hour period by someone exploiting the vulnerability in many supposedly secure websites that used an open-source encryption system.

The CRA said it will send registered letters to affected taxpayers and will not be emailing them because it doesn’t want fraudsters to use phishing schemes to further exploit the privacy breach.

“I want to express regret to Canadians for this service interruption,” CRA commissioner Andrew Treusch said. “I share the concern and dismay of those individuals whose privacy has been impacted by this malicious act.”

Other personal data and possibly businesses’ information may also have been lost.

“We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed,” Treusch said.

Taxpayers whose data was compromised will get bolstered CRA account protection and free access to credit protection services.

Canada’s Privacy Commissioner is also investigating.

Online services, including the E-file and Netfile online income tax portals, were patched and re-launched Sunday after what the CRA called a vigourous test to ensure they are safe and secure.

The CRA cut off access to those services April 8 as word spread that the Heartbleed bug had given hackers access to passwords, credit card numbers and other information at many websites.

People whose income tax filing was delayed by last week’s CRA interruption have been given until May 5 – beyond the usual April 30 filing deadline – to file returns without being penalized.

The Heartbleed vulnerability compromised secure web browsing for up to two years at some sites despite the display of a closed padlock that indicates an encrypted connection.

Just Posted

Okanagan Lake (File photo)
Thompson-Okanagan ready to welcome back tourists

The Thompson-Okanagan Tourism Association expects this summer to be a busy one

Aerial view of a wildfire at 16 Mile, 11 kilometres northwest of Cache Creek, that started on the afternoon of June 15. (Photo credit: BC Wildfire Service)
Wildfire at 16 Mile now being held

Wildfire started on the afternoon of June 15 at 16 Mile, east of Highway 97

The Desert Daze Music Festival is doggone good fun, as shown in this photo from the 2019 festival, and it will be back in Spences Bridge this September. (Photo credit: Barbara Roden)
‘Best Little Fest in the West’ returning to Spences Bridge

Belated 10th anniversary Desert Daze festival going ahead with music, vendors, workshops, and more

Internet speed graphic, no date. Photo credit: Pixabay
Study asks for public input to show actual Internet speeds in BC communities

Federal maps showing Internet speeds might be inflated, so communities lose out on faster Internet

Fireworks are among the things now banned throughout the Kamloops Fire Centre, as the weather heats up and a dry summer looms. (Photo credit: Black Press files)
Category 2 and 3 open fires, fireworks now banned in Kamloops Fire Centre

Ban on certain types of fires and fire activities in place until Oct. 15

People line up to get their COVID-19 vaccine at a vaccination centre, Thursday, June 10, 2021 in Montreal. THE CANADIAN PRESS/Ryan Remiorz
Vaccines, low COVID case counts increase Father’s Day hope, but risk is still there

Expert says people will have to do their own risk calculus before popping in on Papa

John Kromhoff with some of the many birthday cards he received from ‘pretty near every place in the world’ after the family of the Langley centenarian let it be known that he wasn’t expecting many cards for his 100th birthday. (Special to Langley Advance Times)
Cards from all over the world flood in for B.C. man’s 100th birthday

An online invitation by his family produced a flood of cards to mark his 100th birthday

FILE – Nurse Iciar Bercian prepares a shot at a vaccine clinic for the homeless in Calgary, Alta., Wednesday, June 2, 2021. THE CANADIAN PRESS/Jeff McIntosh
B.C. scientists to study effectiveness of COVID vaccines in people with HIV

People living with HIV often require higher doses of other vaccines

A 50-year-old woman lost control of her vehicle Tuesday, June 15, crashing through a West Vancouver school fence that surrounds playing children. (West Vancouver Police)
Driver ticketed for speeding near B.C. school crashes into playground fence days later

‘It’s an absolute miracle that nobody was injured,’ says Const. Kevin Goodmurphy

Dr. Réka Gustafson, who is British Columbia’s deputy provincial health officer, speaks during a news conference in Vancouver on April 8, 2015. THE CANADIAN PRESS/Darryl Dyck
B.C. public health officials prepare to manage COVID-19 differently in the future

Flu-like? Health officials anticipate shift from pandemic to communicable disease control strategies

Maxwell Johnson is seen in Bella Bella, B.C., in an undated photo. The Indigenous man from British Columbia has filed complaints with the B.C. Human Rights Tribunal and the Canadian Human Rights Commission after he and his granddaughter were handcuffed when they tried to open a bank account. THE CANADIAN PRESS/HO-Heiltsuk Nation, Damien Gillis, *MANDATORY CREDIT*
VIDEO: Chiefs join human rights case of Indigenous man handcuffed by police in B.C. bank

Maxwell Johnson said he wants change, not just words, from Vancouver police

Camper the dog was found Wednesday night by someone walking their own dog along Hollywood Crescent. She had gone missing after a violent attack on June 11. (Courtesy of VicPD)
Camper the dog found safe after fleeing violent van attack in Victoria

Young dog was missing for almost a week after incident

Tk’emlups te Secwepemc Chief Rosanne Casimir stands outside the former Kamloops Indian Residential School after speaking to reporters, in Kamloops, B.C., on Friday, June 4, 2021.THE CANADIAN PRESS/Darryl Dyck
Kamloops chief says more unmarked graves will be found across Canada

Chief Rosanne Casimir told a virtual news conference the nation expects to release a report at the end of June

Most Read