The government is responding to threats targeting the GCKey service and CRA accounts, which are used to access federal services.

Dark Reading Staff, Dark Reading

August 19, 2020

1 Min Read

The Canadian government has confirmed credential-stuffing attacks against government service accounts after thousands of peoples' usernames and passwords were stolen and weaponized.

One of the services is GCKey, which is used in about 30 federal departments and lets Canadians access services such as their Employment and Social Development Canada's My Service Canada account, or their Immigration, Refugees, and Citizenship Canada account. There are roughly 12 million active GCKey accounts in Canada, the government says. Credentials of about 9,041 users were fraudulently acquired and used to access government services. One-third were successful. 

"These attacks, which used passwords and usernames collected from previous hacks of accounts worldwide, took advantage of the fact that many people reuse passwords and usernames across multiple accounts," officials say in a statement. 

Affected GCKey accounts were cancelled when the attack was discovered; the government is notifying people affected with instructions on how to receive a new GCKey.

Attackers targeted about 5,500 Canada Revenue Agency (CRA) accounts as part of the GCKey incident and another credential stuffing attack against the CRA, the government reports. It has disabled access to all affected accounts to maintain the security of taxpayers' data. Individuals affected are being notified to restore access to their CRA MyAccount.

Read the full disclosure here.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights