CRA locks out over 800,000 online accounts here's what to know

The Canada Revenue Agency locked more than 800,000 taxpayers out of its online platform on Saturday after an investigation revealed that some usernames and passwords may have been obtained by "unauthorized third parties."

On Friday, the agency said the move is aprecautionary cybersecurity measure and is being taken after a similar action in February,when over100,000 accountsaccounts were locked.

"Like the accounts that were locked in February, these user IDs and passwords were not compromised as a result of a breach of CRA's online systems. Rather, they may have been obtained by unauthorized third parties and through a variety of means by sources external to the CRA," said CRA in a news release.

The agency cited external data breaches and email phishing scams as possible sources of compromised personal information.

As part of its cybersecurity efforts, CRA will lock all accounts that use the same login information as other accounts that have been made available on the so-called"dark web",a part of the internet that can be accessed only through a special browser.

The agency saidthat such "preventative measures ...may become more frequent to safeguard taxpayers' information."

CRA's move comes in the middle of one of the most complicatedtax seasons in recent memory, as millions of Canadians prepare to filetaxes after receivingCOVID-19 benefits.

WATCH |What to do if you've been locked out of your CRA account:

What to do if you've been locked out of your CRA account

3 years ago

Duration 5:26

The Canada Revenue Agency says 800,000 taxpayers will be locked out of their online accounts tomorrow after an investigation revealed that some usernames and passwords have been obtained by "unauthorized third parties."

Next steps for locked accounts

Affected taxpayers will have theiremails removed from their accounts, the agency said, and won't be able to reset passwords using the traditional method on the agency's website. Those who try will receive an error message.

Affected individuals will receiveinstructions on how to regain access to their CRA account, the agency said. Those who have signed up for email notifications from CRA My Account will receive emails, while other affected individuals will receive their instructions by mail.

Individuals can also regain access to their CRA account by using a different login method, such as their banking login, or bycreatinga new user ID and password, which requires requesting that a uniquepersonal identification number (PIN)be sent by mail.

The issues should be fixed by March 22, CRA said, but anyone who hasn't been able to regain access by that date should call the agency.

Affected individuals can visit thiswebpage for more information.

In order to ensure their personal information remains safe, CRA is encouraging allusers of its services to do the following:

• Create a personal identification number (PIN) in CRAMy Account to help confirm their identity on future calls with the CRA.
• Sign up for email notifications.
• Monitor their accounts for suspicious activities, including unsolicited account changes.
• Change passwords regularly.
• Keep account information up to date.
• Installsoftware to removemalware from computers and devices.