The CRA locked the accounts of users whose credentials may have been compromised on third-party leaks, government sources said.