Some CRA Accounts Have Been Breached . . . | General financial discussion | Discussion forum

Looks like some taxpayers used the same password for their CRA account as they used at some other site.

Other site was compromised and hackers found the same password also worked for the victim's CRA account!

CRA account should be fine if it has a different password:

…

The incidents are a type of attack known as "credential stuffing," the Treasury Board's Office of the Chief Information Officer said in a statement.

"These attacks, which used passwords and usernames collected from previous hacks of accounts worldwide, took advantage of the fact that many people reuse passwords and usernames across multiple accounts."

Aside from CRA accounts, thousands of others linked to GCKey — a secure portal that allows Canadians to access government services online — were also affected.

"Of the roughly 12 million active GCKey accounts in Canada, the passwords and usernames of 9,041 users were acquired fraudulently and used to try and access government services, a third of which accessed such services and are being further examined for suspicious activity," the statement read.

…

CRA login is down.

That's only true if one uses the same password at the bank and at CRA separately.

That is not how the sign-in partner system works at CRA. With the system, CRA never has a copy of the password. One actually signs into the bank first and the bank vouches for the person to CRA.

It is secure as long as one does not use that banking password for some unregulated site, like that a bitcoin exchange or some free e-mail site. That would result in another copy of the password stored in a place that is likely easier for hackers to reach undetected than within CRA or within the bank.

If instead the hackers get onto one's home computer and install a keyboard sniffer, then it doesn't matter if one uses different passwords. Over a course of months, the hackers will be able to sniff all the password used.

Kidd said
I'm sorry i paid my june tax installment early, tax payments will be put off indefinitely.

I hear, the CRA have hired the Phoenix payroll programmers to fix their current security issues.  Yeah, good luck with that.  

I hope you are joking about the people behind the Phoenix payroll program being involved. Better count on nothing being done.

I am just stressing about not knowing my September tax instalment amount... any word on when we might know this?

rodeworthy said
Last week we received email from CRA indicating we had new messages. We logged on and determined the messages were notices of the September and December installment amounts. The information is there.

You should be able to get this information once the CRA site is back up.  

Much appreciated. I never got any email updates and my cra account early last week had nothing new. However, it sounds like it will happen soon then if people are being updated.

Current instructions for managing CRA login credentials (Source: CRA website):

To manage any of the following CRA security options, you must first login to a service. Once you have logged in, you can access these options on the "CRA login and security options" page.

Change CRA user ID
Change CRA password
Change CRA security questions and answers
Update additional security feature preference
Revoke CRA user ID
View the Terms and conditions of use
View recent CRA login history

Password
Your password must contain between 8 and 16 characters, one upper-case letter, one lower-case letter, one digit, no space, and no accented characters. The only special characters you can use are: dot (.), dash (-), underscore (_), and apostrophe ('). You cannot use more than 4 consecutive, identical characters. The password and the confirm password must match.

Stephen