Advertisement

CRA accounts locked as a ‘precaution,’ agency says

Click to play video 'Canada Revenue Agency suspended online services after three cyber-security attacks affected 5,600 users' Canada Revenue Agency suspended online services after three cyber-security attacks affected 5,600 users
In August 2020, Annette Butikofer, assistant commissioner of the information technology branch and chief information officer at the Canada Revenue Agency (CRA) said that the CRA was impacted by three cyber-security incidents involving approximately 5,600 accounts and took the decision to shut down its online services after the third incident happened – Aug 17, 2020

The Canada Revenue Agency has temporarily locked an unspecified number of online taxpayer accounts as a “precaution” after an internal analysis revealed some account credentials such as user IDs and passwords may have been compromised, the agency said via email on Wednesday.

Read more: ‘Fear and uncertainty’ — What to expect from your 2021 taxes

“These credentials were not compromised as a result of a breach of CRA’s systems. Rather, they have been obtained through a variety of means by sources external to the CRA,” Christopher Doody, a CRA media relations representative, wrote. “As a precautionary security measure and to prevent unauthorized access to these accounts, we took swift action to lock the accounts and are in the process of contacting the legitimate account holders to unlock their accounts.”

Affected users received an alert on Tuesday saying their emails had been disconnected from their CRA accounts. The tax agency says it will work with those taxpayers to re-establish their credentials, prioritizing COVID-19 benefit recipients who need access to the CRA’s online platform in order to receive payments.

Story continues below advertisement
Click to play video 'Canada Revenue Agency shuts out some taxpayers' Canada Revenue Agency shuts out some taxpayers
Canada Revenue Agency shuts out some taxpayers – Feb 17, 2021

Jeremy Bellefeuille, press secretary at the Office of the Minister of National Revenue, said the CRA is regularly monitoring whether the same credentials taxpayers used for their CRA accounts have potentially been compromised in third-party leaks. If it finds external breaches, the agency locks the accounts.

Taxpayers affected by the precautionary lockouts will receive a letter from the CRA with instructions on how to contact the agency and authenticate themselves, Bellefeuille said.

Bellefeuille urged those who don’t have a pressing need to access their accounts to wait for the letter rather than contact the agency via phone.

However, many taxpayers will likely need to use the CRA’s online platform in the 2021 tax season, which kicks off on Monday, Feb. 22.

The CRA has not said how many taxpayers have been impacted.

Story continues below advertisement
Click to play video 'Better Business Bureau shares cyber tips after CRA hack' Better Business Bureau shares cyber tips after CRA hack
Better Business Bureau shares cyber tips after CRA hack – Aug 23, 2020

And while the tax agency has begun reinstating access to some of the locked accounts, it hasn’t been sharing much information directly with affected users, Global News reporting indicates.

Phyllis Skrzyniak, an aesthetician in Aurora, Ont., for example, has regained control of her account after connecting with a CRA service representative at the end of an almost four-hour wait on Tuesday.

Skrzyniak, who told Global News she let her husband Rob handle most of the call with the CRA because she suffers from anxiety, says she is relieved to have regained access to her account. She was also impressed with the patience and professional demeanour of the CRA agent who handled her call, she says.

But when Skrzyniak spoke with Global News on Wednesday morning she said she still had no idea what prompted the CRA to temporarily freeze her account.

Story continues below advertisement

Read more: CERB recipients deemed ineligible after messaging mix-up won’t be forced to repay

I was just flagged for something I don’t even know of,” she says. “It’s not right that they’re not letting people know what’s happening.”

Across Canada, taxpayers who’ve been shut out of their own CRA accounts without explanation over the past couple of days expressed similar feelings: concern about suddenly being cut off the online platform, frustration at the long phone wait time, and puzzlement at the initial lack of answers about what happened.

Click to play video 'Thousands of CRA, government service accounts targeted by hackers in ‘credential stuffing’ attacks' Thousands of CRA, government service accounts targeted by hackers in ‘credential stuffing’ attacks
Thousands of CRA, government service accounts targeted by hackers in ‘credential stuffing’ attacks – Aug 15, 2020

Dozens of taxpayers have taken to social media sharing similar stories of frozen accounts and hours spent waiting for assistance through CRA phone helplines.

In Summerside, N.L., IT worker Barry Wheeler says he was worried his blocked account might be connected to a security breach like the one CRA reported in August of last year, which compromised the usernames and passwords of thousands of accounts.

Story continues below advertisement

“My anxiety was through the roof,” Wheeler told Global News via email.

Read more: Workplace harassment complaints surge at CRA, Canada Post, internal data shows

Wheeler says a CRA agent restored access to his account on Tuesday evening after three and a half hours on the phone.

“All is good now, and I have to be honest, other than the long wait times, I was pleased with things,” Wheeler wrote, describing the agent he spoke with as “very professional” and “very understanding.”

But not everyone found a resolution at the end of a more than three-hour phone call.

Click to play video 'RCMP announce arrests, Canada-wide warrant in CRA scam' RCMP announce arrests, Canada-wide warrant in CRA scam
RCMP announce arrests, Canada-wide warrant in CRA scam – Feb 14, 2020

In Calgary, Jessy Roos, who runs a small mental health counselling agency, has yet to be allowed back into her CRA account. After a three-hour wait on Tuesday, she says her call was simply disconnected.

Story continues below advertisement

When Roos tried to call CRA at 9 a.m. M.S.T. on Wednesday, she says she couldn’t get through. After a recorded message about all agents being unavailable, the system simply hung up, she says.

Roos, who has been receiving the Canada Recovery Benefit, says she can’t submit a request for her next payment without access to her CRA account.

She plans to phone CRA again later Wednesday, a time-consuming task she expects will eat into her workday. But Roos calls herself “lucky” to be able to set her own hours as a small business owner.

“I have the flexibility to choose when to take these calls and how much time I can spend on it when I know other people don’t necessarily have that choice,” she says.