CRA locks online accounts amid investigation, leaving users worried - Action News
Home WebMail Friday, November 22, 2024, 09:06 PM | Calgary | -11.3°C | Regions Advertise Login | Our platform is in maintenance mode. Some URLs may not be available. |
Science

CRA locks online accounts amid investigation, leaving users worried

The Canada Revenue Agency has locked more than 100,000 taxpayers out of its online platform, telling users their email addresses have been removed from their accounts. The CRA says the move is meant as a security precaution in the context of ongoing investigative work."

More than 100,000 accounts affected, but federal agency says it was not hacked

A computer screen displays the Canada Revenue Agency website.
The Canada Revenue Agency says 800,000 taxpayers will be locked out of their online accounts Saturday after an investigation revealed that some usernames and passwords have been obtained by "unauthorized third parties." (Graham Hughes/The Canadian Press)

The Canada Revenue Agency has locked more than 100,000 taxpayers out of its online platform, telling users their email addresses have been removed from their accounts.

Dozens of users took to social media on Tuesday and Wednesday to report encountering the same "error 021" on their accounts. Several said they spent hours waiting on CRA's helpline to get their accounts unlocked, but either received little information or no response at all. The issue was first reported by the Daily Hive website.

"After being on hold for nearly three hours, the phone disconnected," one user, Jason Bell, wrote to CBC News. "My only emotion right now is worry. Worry that my account, finances or identity have been tampered with."

Late Wednesday afternoon, the CRA said it had not been the target of a cyberattack, but that affected users may have been involved in separate data breaches. They're believed to have been using the same login information for both the agency's website and other online services, the CRA said in a statement to CBC News.

"An internal analysis revealed evidence that some account credentials (i.e. user IDs and passwords) may have been compromised, and may be available for use by unauthorized individuals," CRA spokesperson Christopher Doody said in an email.

In the event of data breaches, personal information such as usernames and passwords isoftenmade available on seedy corners of the internet, such as the dark web.

Earlier, users had been left with few details about the reason they'd been suddenly locked out, with the CRA only describing the move as "a security precaution in the context of ongoing investigative work."

CRA's move was "painful, but smart," according to David Shipley, CEO of the cyberfirm BeauceronSecurity.

"Using breached lists to warn users is increasingly something we see in password managers and browsers," he said in a tweet.

Some taxpayers, however,questioned the agency's lack of communication.

"They could have handled it better instead of having all these people panic thinking they HAVE been breached and spending a whole day calling only to be disconnected each time," Carolyn Azar saidin an email to a reporter.

Doody, the CRA representative, said "we took swift action to lock the accounts and are in the process of contacting the legitimate account holders to unlock their accounts." He previously said affected users would receive information in the mail about how to regain access online.

"There is no urgent need for taxpayers to contact us imminently unless they are an emergency benefit applicant and have active applications in our system," Doody said.

"We will prioritize these calls to minimize delays in the delivery of these crucially important emergency benefits."

CRA said earlier this month it had hired additional call centre agents for what promises to be an exceptionally busy tax season amid the pandemic.

When a reporter dialled a CRA helpline on Tuesday night, he was told to call back later "due to high demand." A recording said "all of our agents are currently busy and our agent queues are full."

The CRA said it has bolstered cybersecurity measures sincedata breaches last year affected thousands of taxpayers.

Add some good to your morning and evening.

Your daily guide to the coronavirus outbreak. Get the latest news, tips on prevention and your coronavirus questions answered every evening.

...

The next issue of the Coronavirus Brief will soon be in your inbox.

Discover all CBC newsletters in theSubscription Centre.opens new window

This site is protected by reCAPTCHA and the Google Privacy Policy and Google Terms of Service apply.