\n
![\"CRA\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/05\/shutterstock_306047279-2.jpg\"\/ "\\"\\"")
<\/p>\nTens of thousands of Canadian taxpayers have been targeted in Canada Revenue Agency (CRA) data breaches since 2020, according to Canada\u2019s privacy watchdog.<\/p>\n
The CRA reported a total of 42,755 confirmed individual data breaches to the Office of the Privacy Commissioner of Canada (OPC) since 2020.<\/p>\n
Privacy Commissioner Philippe Dufresne shared the report with Parliament on Thursday. It concluded that there are \u201cshortcomings\u201d to the CRA\u2019s prevention, monitoring and detection, remediation, and governance.<\/p>\n
Described by the revenue agency as \u201cunauthorized access, disclosure or use\u201d of an individual\u2019s tax information by a third party, the hackers used stolen or leaked information from external sources to gain access to taxpayers\u2019 accounts.<\/p>\n
\u201cBad actors also use legitimate information to modify individuals\u2019 accounts, presumably in an effort to file false tax returns, direct CRA payments to themselves or claim benefits,\u201d reads the OPC\u2019s report.<\/p>\n
\u201cIn addition, attackers can make changes to accounts without ever directly accessing a taxpayer account, for example, by filing a false tax return, or updating information on an account by impersonating and successfully passing challenge questions via a call centre.\u201d<\/p>\n
Report findings
\n<\/p>\n
Africa Studio\/Shutterstock<\/p>\n
Dufresne noted that the CRA was unable to provide the federal privacy watchdog with details of every confirmed data breach due to limitations in its tracking systems.<\/p>\n
Critique provided by the privacy commissioner includes the agency failing to implement mandatory multifactor authentication in a timely manner, and, once it did, \u201cit did not rely on the strongest methods according to industry best practices.\u201d<\/p>\n
The report added that when it came to monitoring and detection, despite relying on many tools, a majority of the CRA data breaches remained self-reported. Dufresne says that combined with the agency\u2019s inability to identify when and how each data breach occurred, it \u201craises questions about the effectiveness of the CRA\u2019s approach.\u201d<\/p>\n
The commissioner made nine recommendations to the CRA, of which eight were accepted fully and one in part.<\/p>\n
CRA responds to the privacy commissioner\u2019s feedback
\n![\"CRA\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/05\/Upped-my-Canadian-patriotism-by-about-5000000-2025-12-19T104833.333.jpg\"\/ "\\"\\"")
<\/p>\n
Erman Gunes\/Shutterstock<\/p>\n
In an email statement to Daily Hive, the revenue agency said it welcomes the commissioner\u2019s findings.<\/p>\n
\u201cThe confidence and trust that individuals and businesses have in the CRA is a cornerstone of Canada\u2019s tax system,\u201d reads the statement. \u201cThe protection of taxpayer information is of the utmost importance to the CRA and in today\u2019s increasingly digital world, the CRA continually takes steps to safeguard sensitive information against ever-evolving threats.\u201d<\/p>\n
The agency said that in 2020, there was a significant increase in the number of identity theft cases<\/a> following the announcement of COVID-19 emergency benefits. It said that, at the time, it focused on protecting accounts, enhancing security measures, and contacting affected taxpayers.<\/p>\n According to the government agency, it continues to implement security measures, technologies and controls with \u201cthreat actors becoming increasingly sophisticated and constantly evolving their tactics.\u201d<\/p>\n This includes mandatory multifactor authentication for all users who access the CRA\u2019s sign-in services.<\/p>\n \u201cAs of February 2026, CRA account users are prompted to add a backup MFA option where applicable, further strengthening the security of taxpayer\u2019s online accounts,\u201d reads the statement.<\/p>\n It added that it also conducts routine checks and analyses to identify user IDs and passwords that may have been hacked. Any that are identified are revoked.<\/p>\n The agency has also implemented a \u201cConfirm my Representative\u201d process for all authorization requests submitted by a third party seeking online access to taxpayer information.<\/p>\n \u201d Taxpayers must confirm or deny these requests in their account or provide specific information to their representative to support the authorization request,\u201d reads the statement.<\/p>\n Lastly, the agency now requires My Account users to have an email address on file and limits new account users to only one credential (either a CRA user ID and password or a Sign-In Partner).<\/p>\n This report<\/a> comes as a nationwide class-action settlement involving the alleged privacy breach of Government of Canada online accounts was approved by the Federal Court earlier this week. Find out<\/a> if you\u2019re eligible and how much you can claim.<\/p>\n","protected":false},"excerpt":{"rendered":"Tens of thousands of Canadian taxpayers have been targeted in Canada Revenue Agency (CRA) data breaches since 2020,…\n","protected":false},"author":2,"featured_media":657723,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[43,44,41,39,42,40],"class_list":["post-657722","post","type-post","status-publish","format-standard","has-post-thumbnail","category-headlines","tag-headlines","tag-news","tag-top-news","tag-top-stories","tag-topnews","tag-topstories"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/657722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=657722"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/657722\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/657723"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=657722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=657722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=657722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}