The Canada Revenue Agency (CRA) headquarters Connaught Building is pictured in Ottawa on Monday, Aug. 17, 2020. THE CANADIAN PRESS/Sean Kilpatrick

The Canada Revenue Agency (CRA) headquarters Connaught Building is pictured in Ottawa on Monday, Aug. 17, 2020. THE CANADIAN PRESS/Sean Kilpatrick

CRA resumes online services with new security features after cyberattacks

All individuals affected by the cybersecurity breaches will receive a letter from the CRA

The Canada Revenue Agency has resumed all online services after fraudsters used thousands of pilfered usernames and passwords to obtain government services.

The agency disabled the services Saturday after discovering more than 5,000 accounts had been the target of three cyberattacks.

Online access to “My Business Account” resumed Monday and all others were brought back online Wednesday evening.

The agency says it regrets the impacts on Canadians and has modified all its security systems to protect against future cyberattacks.

All individuals affected by the cybersecurity breaches will receive a letter from the CRA explaining how to confirm their identity in order to protect and restore access to their account.

The agency urges everyone using its online services to update their accounts with unique passwords they don’t use for any other purpose.

It also recommends all CRA “My Account” users enable email notifications as an additional measure of security.

They can also opt to use a new security feature that will allow them to set up a unique personal identification number to open an account.

About 5,600 CRA accounts were targeted in what the CRA has described as “credential stuffing” schemes, in which hackers used passwords and usernames from other websites to access Canadians’ CRA accounts.

The first of three attacks last week took aim at the GCKey service, which is used by about 30 federal departments and allows Canadians to access services like the My Service Canada account.

By using the previously stolen usernames and passwords, the perpetrators were able to fraudulently acquire about 9,000 of the some 12 million GCKey accounts.

Separately, CRA’s system was hit by credential stuffing attacks. The perpetrators were able to use previously hacked credentials to access the CRA portal. They were also able to exploit a vulnerability that allowed them to bypass the CRA security questions and get into thousands more accounts.

In addition, the CRA portal was directly targeted with a large amount of traffic trying to attack the services through credential stuffing.

The Canadian Press

Canadacybersecurity

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Pictured left to right: Tyrone McDonald, Fire Chief Jamie Wilkinson, General Manager of Community & Protective Services Paul Edginton, Uwe Kurth (ASFA), City Manager Sue Howard, Deputy Fire Chief Alex Plant, Mayor Tyler Gandam. Photo/ City of Wetaskiwin.
City of Wetaskiwin Fire Services sends gear to firefighters in Paraguay

Former City of Wetaskiwin Fire Services member spearheading this initiative.

Alberta Chief Medical Officer of Health Dr. Deena Hinshaw reported an additional 456 COVID-19 cases over the past 24 hours. (photography by Chris Schwarz/Government of Alberta)
Five new COVID-19 deaths in Central zone, two in Red Deer

Province reports 456 new cases of COVID-19

File photo
Wetaskiwin Crime Reduction Unit recovers valuable stolen property

Property valued at over $50,000 recovered by Wetaskiwin Crime Reduction Unit.

Black Press file photo
Leduc RCMP arrest male for multiple break and enters and theft

34-year-old Michael Gilchrist has been arrested for his involvement in the thefts.

25-year-old Rachelle Okrusko has been missing since Jan. 12, 2021. Photo provided by Wetaskiwin RCMP.
Update: Wetaskiwin RCMP looking for missing woman; Rachelle Okrusko is no longer missing.

25-year-old Rachelle Okrusko has been missing since Jan. 12, 2021.

A scene from “Canada and the Gulf War: In their own words,” a video by The Memory Project, a program of Historica Canada, is shown in this undated illustration. THE CANADIAN PRESS/HO - Historica Canada
New video marks Canada’s contributions to first Gulf War on 30th anniversary

Veterans Affairs Canada says around 4,500 Canadian military personnel served during the war

In this March 28, 2017, file photo, a dump truck hauls coal at Contura Energy’s Eagle Butte Mine near Gillette, Wyo. Public opposition to the Alberta government’s plans to expand coal mining in the Rocky Mountains appears to be growing. THE CANADIAN PRESS/AP/Mead Gruver, File
Alberta cancels coal leases, pauses future sales, as opposition increases

New Democrat environment critic Marlin Schmidt welcomed the suspension

In this March 28, 2017, file photo, a dump truck hauls coal at Contura Energy’s Eagle Butte Mine near Gillette, Wyo. (THE CANADIAN PRESS/AP/Mead Gruver, File)
First Nations seek to intervene in court challenge of coal policy removal

Bearspaw, Ermineskin and Whitefish First Nations are among those looking to intervene

Prime Minister Justin Trudeau provides an update on the COVID-19 pandemic from Rideau Cottage in Ottawa on Tuesday, Jan. 11, 2021. THE CANADIAN PRESS/Sean Kilpatrick
Prime Minister Justin Trudeau provides an update on the COVID-19 pandemic from Rideau Cottage in Ottawa on Tuesday, Jan. 11, 2021. THE CANADIAN PRESS/Sean Kilpatrick
Trudeau vows to keep up the fight to sway U.S. on merits of Keystone XL pipeline

Canada’s pitch to the Biden team has framed Keystone XL as a more environmentally friendly project than original

Central Alberta’s Catherine Hayreceived a letter from the Government of Canada recently stating she had to repay the government. Photo submitted
Central Albertan asked to repay CERB amount

Catherine Hay says she received a letter in November saying she had to completely repay the benefit

A health-care worker prepares a dose of the Pfizer-BioNTech COVID-19 vaccine at a UHN COVID-19 vaccine clinic in Toronto on Thursday, January 7, 2021. THE CANADIAN PRESS/Nathan Denette
No Pfizer vaccines arriving in Canada next week; feds still expect 4M doses by end of March

More cases of U.K. variant, South African variant found in Canada

Health-care workers wait in line at a UHN COVID-19 vaccine clinic in Toronto on Thursday, January 7, 2021. THE CANADIAN PRESS/Nathan Denette
Canadians who have had COVID-19 should still get the vaccine, experts say

Pfizer-BioNTech and Moderna vaccines were found to have a 95 per cent efficacy

An empty Peel and Sainte-Catherine street is shown in Montreal, Saturday, Jan. 9, 2021, as the COVID-19 pandemic continues in Canada and around the world. THE CANADIAN PRESS/Graham Hughes
Poll finds strong support for COVID-19 curfews despite doubts about effectiveness

The poll suggests 59 per cent remain somewhat or very afraid of contracting COVID-19

Lacombe is looking at its options for reclaiming sewage lagoons that are no longer needed. Vesta Energy Ltd. has signed a deal to use three lagoons to store water for fracking.
Map from City of Lacombe
Energy company to use former Lacombe sewage lagoons to store water for fracking

Vesta Energy Ltd. will pay Lacombe more than $100,000 a year in 20-year deal

Most Read