Government of Canada response to OPC Report on 2020 Cyber Attacks

February 15, 2024 – Ottawa, Ontario – Treasury Board of Canada Secretariat

The President of the Treasury Board, Anita Anand, Minister of Citizens’ Services, Terry Beech, and the Minister of National Revenue, Marie-Claude Bibeau, today issued the following statement in response to the Office of the Privacy Commissioner’s Report on the 2020 Cyber Attacks:

“The Government of Canada, like every other government and private sector organization in the world, deals with cyber security risks and threats every day. That is why we have effective safeguards and procedures in place, which are continuously strengthened to detect, disrupt, and prevent cyber threats.

The Government of Canada welcomes the Office of the Privacy Commissioner’s (OPC) report of findings on the 2020 cyber attacks against the Government of Canada.

In August 2020, the government quickly responded to cyber attacks made against Employment and Social Development Canada’s (ESDC) GCKey service and the Canada Revenue Agency’s (CRA) Authentication Management System/Credential Management System. These systems were used by Canadians to access emergency COVID-19 benefits that were developed by the government to respond to the unprecedented financial impact of the pandemic in 2020. The cyber attacks used usernames and passwords stolen in previous, unrelated, breaches involving non-governmental third parties.

Government departments worked quickly to protect Canadians’ personal information when the threat was first discovered. The Government of Canada cancelled thousands of GCKey accounts and locked those that were potentially affected. In addition, safeguards were added to prevent additional unauthorized activity. 

Since that time, the Treasury Board of Canada Secretariat (TBS), ESDC, CRA, and Shared Services Canada (SSC) have taken additional steps to further safeguard personal information and coordinate efforts to prevent against future cyber threats.

For example, the Government of Canada has proactively implemented multi-factor authentication for key online services and updated the Government of Canada Cyber Security Event Management Plan to help strengthen and coordinate efforts to prevent and respond to cyber incidents impacting the Government of Canada and its systems.

The Government of Canada takes the privacy rights of Canadians seriously and is continuously adopting measures to safeguard their personal information held by government institutions. It will continue to collaborate with the Office of the Privacy Commissioner of Canada to help ensure Canadians' personal information is kept safe and secure.”