Credential Stuffing Attacks Shut Down Canada's Revenues Service



canada revenue agency cybersecurity scam covid-19The Canada Revenue Agency is investigating two online hacking incidents affecting the personal information of thousands of Canadians, according to CBC News.

The Canada Revenue Agency has temporarily shut down its online services, which means that anyone attempting to apply for emergency COVID-19 benefits, such as the Canada Emergency Response Benefit or the Canada Emergency Student Benefit, will be unable to do so until further notice. 

"The CRA quickly identified the impacted accounts and disabled access to these accounts to ensure the safety and security of the taxpayer's information," CRA spokesperson Christopher Doody wrote in an email. "The CRA is continuing to analyze both incidents. Law enforcement assistance has been requested from RCMP and an investigation has been initiated."

While the breaches have been contained, services connected to My Account, My Business Account and Represent a Client on the CRA website have been disabled as an additional safety measure. 

my account covid 19 CRA

Canadians attempting to log in to their Canada Revenue Agency accounts are met with a message informing them that they will not be able to access their accounts until further notice. 

Earlier this month, Canadians began reporting online that email addresses associated with their CRA accounts had been changed, that their direct deposit information was altered and that CERB payments had been issued in their name even though they had not applied for the COVID-19 benefit.

The incidents are a type of attack known as "credential stuffing," the Treasury Board's Office of the Chief Information Officer shared in a statement.

"These attacks, which used passwords and usernames collected from previous hacks of accounts worldwide, took advantage of the fact that many people reuse passwords and usernames across multiple accounts."

Cases such as this could be prevented through new-school security awareness training. Users can learn how to spot the warning signs as they continue to work in a remote environment. 

CBC News has the full story


How vulnerable is your network to hacked user passwords?

25% of employees use the same password for all logins. What if that password is available on the dark web? A massive amount of passwords are compromised due to data breaches and used by the bad guys for attacks. KnowBe4’s free Breached Password Test (BPT) checks to see if your users are currently using passwords that are in publicly available breaches associated with your domain. BPT checks against your Active Directory and reports compromised passwords in use right now so that you can take action immediately!

BPT-1Here's how it works:

  • Checks to see if your company domains have been part of a data breach that included passwords
  • Checks to see if any of those breached passwords are currently in use in your Active Directory
  • Does not show/report on the actual passwords of accounts
  • Just download the install and run it
  • Results in a few minutes!

Check Your Passwords

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/breached-password-test

Subscribe To Our Blog


Free Cybersecurity Awareness Month Resource Kit




Get the latest about social engineering

Subscribe to CyberheistNews