CRA and GCKey Accounts Hijacked: What the Report Found
No government database was cracked. Attackers simply logged in, using usernames, passwords and security answers that had leaked from other websites.
By Siddharth ShankarUpdated October 11, 2026Canada's privacy commissioner reported to Parliament on February 15, 2024 that attackers used credential stuffing to reach about 26,000 Canada Revenue Agency (CRA) My Accounts and about 6,000 Employment and Social Development Canada (ESDC) accounts in 2020. The OPC found both departments broke the Privacy Act, and both now require multi-factor authentication. See what a leaked password can unlock.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Government accounts hold some of the most useful details a thief can want: a social insurance number, a date of birth, a bank deposit setting. In 2020, attackers did not need to defeat government security to get at those accounts. They arrived with keys that people had already lost somewhere else.
What happened
According to the Office of the Privacy Commissioner of Canada, attackers used credential stuffing in July and August 2020. Bots tried usernames, passwords and security-question answers that had been stolen in earlier breaches of other services. When a combination matched, the bot was in.
The CRA detected the attack on August 7, 2020 after a tip from law enforcement. It shut its online portal on August 15, and ESDC shut its own portal on August 20. The OPC published its special report to Parliament on February 15, 2024.
How it worked
Credential stuffing depends on one human habit: reusing logins. If the same email and password protect a shopping site and a tax account, a breach of the shopping site becomes a key to the tax account.
At the CRA the OPC found an additional weakness. A misconfiguration about 20 months old caused the system to skip the security-question check when a login came from a new device. The very control meant to catch unfamiliar logins was not firing.
What was exposed
The OPC reports that attackers used about 26,000 CRA My Accounts and one Represent a Client account, plus about 6,000 ESDC My Service Canada Accounts and 112 ESDC business accounts. In terms of people, it counted about 34,000 affected CRA individuals and about 14,000 affected ESDC individuals.
The exposed information included contact details, identifiers such as social insurance numbers and dates of birth, and financial, banking and employment information. Attackers changed direct deposit and address details and applied for benefits and tax refunds. ESDC found more than 2,000 identity theft cases, and the Represent a Client breach exposed information on more than 8,000 individuals tied to 36 businesses.
How it ended
The OPC found that both departments contravened the Privacy Act, on unauthorized disclosure and on accuracy. Both accepted recommendations. Since the breach, both departments have made multi-factor authentication mandatory and added checks on direct-deposit changes. Shared Services Canada implemented multi-factor authentication for GCKey on an opt-out basis from September 1, 2023, so it is on unless the user opts out.
For individuals the outcome depends on the case. Some had benefit payments redirected or tax returns filed in their name, and repairing that takes time even after the fix.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Key facts at a glance
- Method: credential stuffing with logins stolen elsewhere
- Period: July to August 2020
- CRA My Accounts used: about 26,000
- ESDC accounts used: about 6,000 personal and 112 business
- Individuals affected: about 34,000 (CRA) and 14,000 (ESDC)
- Report date: February 15, 2024
What you can do
1Use a different password for every account
A password manager makes this practical. See our credential stuffing guide.
2Turn on multi-factor authentication for tax, benefit and banking accounts
A stolen password alone is then not enough.
3Check direct deposit and address details
A changed bank account or mailing address is a common sign of takeover. Look at both after any breach.
4Check your email against breach data
Our guide to checking whether your email was exposed explains how, and which old leaks matter most.
What the report does not say
We have used only the counts and findings the OPC gives. The special report is the source for every figure here, and we have not added details from other coverage. For a similar account takeover story in another country, see the 23andMe case.
Why this case matters
Government portals are attractive because one login can lead to several things at once: a tax record, a benefit payment and a bank deposit setting. That makes a reused password more dangerous here than on a typical shopping site.
The case also shows how a small configuration error can undo a good control. A security question that is skipped on new devices protects nobody. Mandatory multi-factor authentication, which both departments now use, is a much stronger barrier because a leaked password alone no longer opens the door.
The practical next step is similar for most people. Read up on how credential stuffing works, how to check whether your email has been exposed and what to do after your email appears in a breach, then review your own accounts. You can also try our free email exposure check.
Sources
- Office of the Privacy Commissioner of Canada: Special report to Parliament on the CRA and ESDC cyber attacks (July-August 2020 attacks, 20-month-old misconfiguration, accounts and people affected)
Frequently asked questions
What is credential stuffing?
It is an attack where bots try logins stolen from one site on many other sites. It works because many people reuse the same password and security answers.
Were CRA and ESDC systems hacked?
The OPC describes attackers logging in with real credentials, not breaking the databases directly. A CRA misconfiguration also allowed a security question to be skipped on new devices.
How many people were affected?
The OPC counted about 34,000 individuals at the CRA and about 14,000 at ESDC, with more than 2,000 identity theft cases found at ESDC.
Is multi-factor authentication required now?
According to the OPC, both departments have made it mandatory since the breach. For GCKey, multi-factor authentication began on an opt-out basis on September 1, 2023.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.