The IT Nerd

The Canada Revenue Agency is once again the victim of being pwned. This time it looks like they got pwned via a supply chain attack. Here’s what went down:

At the height of this year’s tax season, the Canada Revenue Agency discovered that hackers had obtained confidential data used by one of the country’s largest tax preparation firms, H&R Block Canada.

Imposters used the company’s confidential credentials to get unauthorized access into hundreds of Canadians’ personal CRA accounts, change direct deposit information, submit false returns and pocket more than $6 million in bogus refunds from the public purse, an investigation by CBC’s The Fifth Estate and Radio-Canada has found.

In one case, the hackers filed a return with a legitimate postal code, but a fake address on a non-existent Tomato Street.

“Obviously the door is open and some people are infiltrating the system,” André Lareau, an associate tax professor at Laval University in Quebec City, said in an interview. “But the CRA does not seem to have found the key to lock the door.”

According to sources, the crisis prompted the CRA to contact the office of Revenue Minister Marie-Claude Bibeau.

How many Canada Revenue Agency accounts could we be talking about? How about this:

In answers to questions from The Fifth Estate/Radio-Canada, the CRA admitted it has been hit with more than 31,468 “material” privacy breaches from March 2020 to December 2023, affecting 62,000 individual Canadian taxpayers.

This is pretty bad. And given that the Canada Revenue Agency has been pwned so many times over the years, which has led to a lawsuit over their last round of getting pwned, you’d think that they would up their game. But clearly that’s not the case. And Canadians should expect not only answers about why getting pwned is still a problem with the Canada Revenue Agency, but concrete steps on how they are going to stop getting pwned. In the meantime, I would encourage all Canadians to check their Canada Revenue Agency accounts to make sure that they are not victims of this. And I would do that ASAP.

Another day, another big data breach. This time it’s Landmark Admin which is an Insurance administrative services company. According to a filing with  the Main Attorney General’s office, the company said that it was the victim of a cyberattack back in May and over 800,000 people have had the following information stolen:

“Based on the investigation, the following information related to potentially impacted individuals may have been subject to unauthorized access: first name/initial and last name; address; Social Security number; tax identification number; driver’s license number/state-issued identification card; passport number; financial account number; medical information; date of birth; health insurance policy number; and life and annuity policy information,”

Well that sucks. Though what sucks more is the fact that we’re in late October and the public is only finding out about this company being pwned back in May. In any case, the company goes on to say that impacted people should monitor their credit reports and bank accounts for suspicious activity. How do you know if you’re impacted, well the company will reach out to you to let you know if you’ve been affected.

Personally, if I were affected by this, I’d want to know why it took so long to make this information public. I’m hoping that somebody is going to ask that question. As in someone in government that has the power to compel the company to serve up the answer to that question.

Disability nonprofit Easterseals filed a breach notification with regulators after the Rhysida ransomware group attempted to extort $1.3 million from the organization this week.

Easterseals, which provides support to disabled children, seniors, military veterans and others, stated that on April 1 its Peoria-based Central Illinois location “experienced a network disruption that impacted the functionality and access of certain systems.”

The investigation determined that the bad actor accessed certain files from Easterseals’ network, some of which includes personal information of almost 15,000 individuals, such as:

• Full names
• Addresses
• Driver’s licenses
• SSNs 
• Medical information
• Passports 

The nonprofit serves more than 1.5 million people across the country and provides additional services to 100,000 physicians. Easterseals says that more than 80% of its fundraising is spent directly on care for the disabled. 

Stephen Gates, Principal Security SME, Horizon3.ai had this to say:

  “Nonprofits are no longer immune to cyberattacks, despite their humanitarian missions. Attackers likely target them for three main reasons: their vast stores of confidential donor data, often weak security postures, and constrained IT budgets. These organizations face the growing challenge of doing more with less.

  “Now is the time for non-profits to conduct thorough assessments of their networks, identifying blind spots beyond just known vulnerabilities. Easily compromised credentials, exposed data, misconfigurations, weak security controls, and inadequate policies are significant threats. The cost of traditional, human-led risk assessments can be prohibitive, but autonomous solutions are now available to deliver affordable, efficient assessments that anyone can use.”

This of course isn’t good. But it does illustrate that any sector is a target from threat actors like these. Thus every group needs to do what they need to do to keep threat actors out, and by extension not become the next headline.