Canada police nab young man in Heartbleed data theft

Apr 16, 2014
A Royal Canadian Mounted Police (RCMP) officer checks a security perimeter in front of the Parliament building in Ottawa, Ontario, Canada on February 19, 2009

Federal police said Wednesday they have arrested and charged a 19-year-old man in the theft of 900 Canadian taxpayers' data, which was made vulnerable by the "Heartbleed" bug.

The Royal Canadian Mounted Police (RCMP) said Stephen Arthuro Solis-Reyes was arrested at his London, Ontario home on Tuesday without incident.

He is scheduled to appear in court on Thursday to face charges of mischief and unauthorized use of a computer to steal data from the Canada Revenue Agency (CRA)'s website.

"It is believed that Solis-Reyes was able to extract private information held by the CRA by exploiting the known as the Heartbleed Bug," the RCMP said in a statement.

The suspect was tracked down within four days after what CRA Assistant Commissioner Gilles Michaud had described as a serious security breach.

Police said computer equipment was seized at the suspect's home, and that the investigation is still ongoing.

The Canada Revenue Agency said 900 social insurance numbers—personal nine-digit codes required for working or accessing government benefits in Canada—had been stolen last week by "someone exploiting the Heartbleed ."

Its website was shuttered for several days over concerns about the Heartbleed bug.

It was rebooted over the weekend after a patch was installed.

The recently-discovered flaw in online-data scrambling software OpenSSL allows hackers to eavesdrop on online communications, steal data, impersonate websites and unlock encrypted data.

OpenSSL is commonly used to protect passwords, and other data sent via the Internet.

More than half of websites use the software, but not all versions have the same vulnerability, according to heartbleed.com.

Cybersecurity firm Fox-It estimates that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.

Explore further: Canadians' tax data stolen in Heartbleed breach

add to favorites email to friend print save as pdf

Related Stories

'Heartbleed' bug a critical Internet illness

Apr 11, 2014

The "Heartbleed" flaw in Internet security is as critical as the name implies and wider spread than first believed. Warnings about the danger exposed early this week reached widening circles on Thursday, with everyone from website o ...

Recommended for you

Hacker gets prison for cyberattack stealing $9.4M

Oct 24, 2014

An Estonian man who pleaded guilty to orchestrating a 2008 cyberattack on a credit card processing company that enabled hackers to steal $9.4 million has been sentenced to 11 years in prison by a federal judge in Atlanta.

Report: Better shields needed for private tax data

Oct 23, 2014

Federal investigators say the IRS and the states should improve how they protect the security of confidential tax information of people getting benefits under the 2010 health care law.

Apple issues security warning for iCloud

Oct 22, 2014

Apple has posted a new security warning for users of its iCloud online storage service amid reports of a concerted effort to steal passwords and other data from people who use the popular service in China.

User comments : 0