Canada: more than 42,000 data breaches in the tax system since 2020

The Privacy Commissioner issued nine recommendations to the Canada Revenue Agency, which accepted eight in full and one in part.

Canada’s federal privacy watchdog revealed on May 7, 2026 that it had recorded more than 42,000 data breaches within the Canada Revenue Agency (CRA) since 2020. In a report tabled in Parliament, Philippe Dufresne, Privacy Commissioner, highlighted shortcomings in the CRA’s mechanisms for preventing, monitoring and managing data leaks.

Cybercriminals have thus been able to regularly access or modify taxpayers’ personal information without authorization. “Malicious actors are also using authentic information to modify individuals’ accounts, likely in order to file fraudulent tax returns, divert CRA payments for their own benefit, or apply for benefits,” the report reads.

Philippe Dufresne notably flagged the delay in deploying multi-factor authentication. He issued nine recommendations to the CRA, eight of which were accepted in full and one in part.