Cyberattacks targeting CRA, Canadians' COVID-19 benefits have been brought under control: officials

Fraudsters exploited a security vulnerability in the Government of Canada website and took advantage of login credentials exposed through previous hacks to conduct a series of cyberattacks thatcompromised the personal information of thousands of Canadians, federal officials say.

As first reported by CBC News, the attacks targeted the Canada Revenue Agency (CRA) and GCKey, a secure online portal that allows Canadians to access services such as employment insurance, veterans' benefits and immigration applications. The attackscome at a time when millions of Canadians have been relying on the CRA's website to apply for and access COVID-19 emergency benefits.

While the breaches have been contained, the schemes allowed hackers to fraudulently access government services and apply for or redirect payments to themselves.

Acting chief information officer for the Treasury Board of Canada Secretariat Marc Brouillardsaid at a technical briefing in Ottawa on Monday that the attacks were a form of "credential stuffing,"where hackers fraudulently obtain usernames and passwords to accounts on other websites, and take advantage of the fact that many people use the same password for different accounts.

"The bad actors were able to use the previously hacked credentials to access the CRA portal. They were also able to exploit a vulnerability in the configuration of security software ...which allowed them to bypass the CRA security questions and gain access to a user's CRA account," Brouillard said on Monday."Because of the systems that we have in place, we were able to detect these attacks early on and have been largely been able to mitigate the impact to Canadians."

A total of 11,200 accounts were impacted in the attacks, Brouillardsaid, including more than 9,000 GCKey accounts and another 5,600 CRA accounts, although almost half the CRA accounts were linked to the GCKey hack.

Brouillard said the affectedaccounts were cancelled as soon as the threat was discovered, and departments are contacting users whose credentials were compromised to provide instructions on how to receive a new GCKey.

CRA online services for individuals temporarily disabled

Earlier this month, Canadians began reporting online thatemail addresses associated with their CRA accounts had been changed, that their direct deposit information was altered and that CERBfunds orother payments had been issued in their name even though they had not applied for the COVID-19 benefit.

Most reported that they were first alerted to the suspicious activity after receiving legitimate emails from the CRA stating that their email addresses had been discontinued.

WATCH| Hackers used stolen passwords to breach CRAaccounts: government:

Hackers used stolen passwords to breach CRA accounts: government

4 years ago

Duration 1:42

Hackers that accessed the personal information of thousands of Canadians by targeting Canada Revenue Agency and GCKey accounts got in by using user logins and passwords stolen from other accounts.

Annette Butikofer, chief information officer at CRA, said the tax agency was impacted by three separate cybersecuritybreaches. The agency became aware of the first breach onAug.7.

The agency contacted the RCMP on Aug.11 and began to step up its own security measures,Butikofersaid.

Canadians were only notified of the breach over the weekend when CRAtemporarily became the target of another attack and decided toshut down its online platforms,cutting off access toservices connected toMy Account, My Business Account and Represent a Client.

Butikofersaid My Business Account, which is used by employers, is back online with additional safety measures so employers can apply for the most recent round of the emergency wage subsidy.

She said CRA hopes to have its online services for individualsback up and running by mid-week. In the meantime,Canadians can still apply for COVID-19 benefit programs by calling 1-800-959-8281.

CRA is sending letters to Canadians whose accounts were breached with instructions about how they can confirm their identify and regain access. Anyone who becomes a victim of identity theft will be eligible for creditor protection and will be "made whole,"Butikofersaid.

Lori MacDonald, chief operating officer of Service Canada, apologized on behalf of theGovernment of Canada for any inconvenience caused by the attack.

The government is advising Canadians to use unique passwords for all online accounts and to check for suspicious activity.

"If you've been a victim here, there's a good chance you're a victim elsewhere, as well," Brouillardsaid. "These credentials were stolen at some point in the past and these hackers are reusing them."

RCMP investigating

The RCMP has confirmed that its National Division, which investigates "sensitive, high profile cases that threaten Canada's political, economic and social integrity," is actively looking into the attacks.

At today's briefing, officials wouldn't say if they're aware of who is responsible for the attack, but they didn't rule out the possibility that foreign actors were responsible. The Canadian government was previously targeted by foreign hackers in 2011; they stolehighly classified federal information.

WATCH | U.K. condemns Russia for cyberattacks on COVID-19 vaccine developers:

U.K. condemns Russia for cyberattacks on COVID-19 vaccine developers

4 years ago

Duration 0:36

U.K. Foreign Secretary Dominic Raab said it was 'pretty appalling' of Russia to be involved in the cyberattacks on Britain, Canada and the U.S.

More recently, ahackergroup suspected of being backed by theRussian governmenttriedto steal COVID-19-related vaccine research in Canada, the U.K. and the U.S., according to intelligence agencies in all three countries.

The Canadian Anti-Fraud Centre, a federal agency, saidmore than 13,000 Canadians have been victims of fraud totalling $51 million this year. There have been 1,729 victims of COVID-19 fraud worth $5.55 million.