A recent cybersecurity incident involving taxpayer contact information was disclosed by the Federal Government. Individuals and businesses should remain alert and follow established cybersecurity best practices.
What happened?
On September 9, 2025, the Federal Government released a statement regarding a data security incident involving non-sensitive personal information. Specifically:
- Phone numbers linked to certain Canada Revenue Agency (CRA) and Employment and Social Development Canada (ESDC) accounts, and
- Email addresses associated with Canada Border Services Agency (CBSA) accounts
were accessed during a window of exposure (August 3 to August 15, 2025) caused by a software update vulnerability.
Importantly, there is no evidence that sensitive personal data (such as financial information or identification numbers) was accessed or disclosed. No immediate action is required unless you have been directly notified that your information was affected.
What you should watch out for
Even though this incident does not appear to represent a major breach, there is potential for misuse of exposed phone numbers and email addresses. Scammers often use that kind of data to launch phishing, smishing (text message scams), impersonation or spoofing attacks.
Here’s what you (and your team) should do:
- Be extra wary of unexpected or unusual messages
- Use complex, unique passwords
- Enable Multi-Factor Authentication (MFA) wherever possible
- Monitor your accounts for suspicious activity
How we can help
While this incident was limited and no sensitive data appears to have been accessed, it serves as a reminder that vigilance is key. Ensure your passwords are strong and unique, enable MFA on important accounts, and always verify communications before taking action.
If you have questions about dealing with the CRA, or would like support with any tax, accounting, or business advisory services, please reach out to the team at Bateman MacKay LLP.
