Hackers were able to access usernames and passwords of over 9000 accounts for online government services the Treasury Board of Canada Secretariat said on Saturday.

Hackers were able to get credentials for thousands of accounts for tools that are used to access many government services.

“The Government of Canada is taking action in response to “credential stuffing” attacks mounted on the GCKey service and CRA accounts,” the Treasury Board said in a statement.

Credential stuffing attacks are defined as cyber attacks where hackers use credentials from previous data breaches to gain access to user accounts under the assumption that many people reuse passwords and usernames across multiple accounts.

“Used by approximately 30 federal departments, GCKey allows Canadians to access services like Employment and Social Development Canada’s My Service Canada Account or their Immigration, Refugees and Citizenship Canada account,” it said.

Hackers were able to acquire passwords and usernames of 9,041 users. These credentials were then used to try and access government services, a third of which accessed such services and are being further examined for suspicious activity according to the release.

These accounts were cancelled as soon as the breach was discovered. Authorities are in the process of contacting the users whose accounts have been compromised on how to receive a new GCKey.

According to the official statement, approximately 5,500 CRA accounts were targeted as part of the GCKey attack and another recent “credential stuffing” attack aimed at the CRA.

“Access to all affected accounts has been disabled to maintain the safety and security of taxpayers’ information and the Agency is contacting all affected individuals and will work with them to restore access to their CRA MyAccount,” the board said.

comment COMMENT NOW