News Summary

A security breach at Ottawa-based digital security firm 2Keys has exposed email addresses and phone numbers linked to accounts at the Canada Revenue Agency (CRA), Employment and Social Development Canada (ESDC), and Canada Border Services Agency (CBSA). The breach occurred due to a vulnerability in a routine software update, affecting users who accessed their accounts using 2Keys’ multi-factor authentication (MFA) service between August 3rd and August 15th. The attacker used the stolen phone numbers to send phishing links via spam text messages. 2Keys has since addressed the vulnerability and restored its MFA service, with investigations ongoing alongside external cybersecurity experts. There is no indication that any additional sensitive information was disclosed. 2Keys, acquired by Interac in 2019, provides digital security tools for various clients including the Canadian government.