Thousands of Canadian government accounts hacked, Treasury Board of Canada Secretariat say

The Treasury Board of Canada Secretariat confirmed that thousands of user accounts for online Canadian government services were recently hacked.

According to a press release issued by the Treasury Board of Canada Secretariat, thousands of user accounts for online government services were recently hacked.

The hackers targeted the GCKey service with credential stuffing attacks, the service is used by some 30 federal departments and Canada Revenue Agency accounts.

GCKey allows Canadian citizens to access services like Employment and Social Development Canada’s My Service Canada Account or their Immigration, Refugees and Citizenship Canada account.

Threat actors fraudulently acquired login credentials of 9,041 GCKey account holders and used them to try and access government services.

In response to the incident the agency has cancelled the affected accounts.

“The Government of Canada is taking action in response to “credential stuffing” attacks mounted on the GCKey service and CRA accounts. These attacks, which used passwords and usernames collected from previous hacks of accounts worldwide, took advantage of the fact that many people reuse passwords and usernames across multiple accounts.” states the press release.

The authorities also revealed that approximately 5,500 CRA accounts were targeted as part of the GCKey attack and another recent “credential stuffing” attack.

Government experts disabled access to all affected accounts, the Agency is notifying the affected individuals and will help them to restore access to their CRA MyAccount.

The government is investigating the attack to determine the extent of the incident and whether information was obtained by the attackers.

According to the CBC, several Canadian citizens have reported since the beginning of August that their banking information associated with their Canada Revenue Agency accounts has been changed. 

“Earlier this month, Canadians began reporting online that email addresses associated with their CRA accounts had been changed, that their direct deposit information was altered and that CERB payments had been issued in their name even though they had not applied for the COVID-19 benefit.” reported CBA.

Canadians reported that payments related to the Canadian Emergency Benefit established by the Canadian government in response to the COVID-19 pandemic, have also been issued in their names without their request.

Pierluigi Paganini

(SecurityAffairs – hacking, Canadian government)