Canadian Government Issues Statement on Credential-Stuffing Attacks

The Canadian government has confirmed credential-stuffing attacks against government service accounts after thousands of peoples' usernames and passwords were stolen and weaponized.

One of the services is GCKey, which is used in about 30 federal departments and lets Canadians access services such as their Employment and Social Development Canada's My Service Canada account, or their Immigration, Refugees, and Citizenship Canada account. There are roughly 12 million active GCKey accounts in Canada, the government says. Credentials of about 9,041 users were fraudulently acquired and used to access government services. One-third were successful. 

"These attacks, which used passwords and usernames collected from previous hacks of accounts worldwide, took advantage of the fact that many people reuse passwords and usernames across multiple accounts," officials say in a statement. 

Affected GCKey accounts were cancelled when the attack was discovered; the government is notifying people affected with instructions on how to receive a new GCKey.

Attackers targeted about 5,500 Canada Revenue Agency (CRA) accounts as part of the GCKey incident and another credential stuffing attack against the CRA, the government reports. It has disabled access to all affected accounts to maintain the security of taxpayers' data. Individuals affected are being notified to restore access to their CRA MyAccount.

Read the full disclosure here.