Canada shutters tax filing website over 'Heartbleed' bug

April 9, 2014

Canada's tax agency shuttered its website Wednesday after warning that encrypted taxpayer data could be vulnerable to the "Heartbleed" bug.

The Canada Revenue Agency (CRA) said the decision, which comes only three weeks before the annual income tax filing deadline, was taken as a "preventative" measure.

"The CRA has temporarily shut down public access to our online services to safeguard the integrity of the information we hold," it said.

Later the CRA said it was "working on a remedy" and hoped to have its website back up and running in three to four days.

Canadian taxpayers are expected to file their tax returns for 2013 with the Canadian Revenue Agency by April 30.

Missing the filing deadline usually results in stiff penalties, but the CRA said "consideration" would be given to anyone affected by the website service interruption.

The agency last week said in a Twitter message that it was processing 1,763 online returns per minute—a seasonal high.

As of March 24, 6,787,284 tax returns had been filed with the government agency, it said. Of those, 83.5 percent were filed online.

There are an estimated 22 million taxpayers in Canada.

The freshly-discovered flaw in online-data scrambling software OpenSSL allows hackers to eavesdrop on online communications, steal data, impersonate websites and unlock encrypted data.

OpenSSL is commonly used to protect passwords, credit card numbers and other data sent via the Internet.

More than half of websites use the software, but not all versions have the same vulnerability, according to

Cyber security firm Fox-It estimates that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.

Computer security specialists, website masters and others began fretting about the bug this week after several reports of hacking.

The CRA said it would investigate any theft and abuse of taxpayer information resulting from security breaches.

Explore further: Heartbleed bug find triggers OpenSSL security advisory

Related Stories

Heartbleed bug find triggers OpenSSL security advisory

April 8, 2014

A flaw called Heartbleed in OpenSSL, which is a software library used for the protection and security of millions of websites, was uncovered by Neel Mehta of Google Security, who first reported it to the OpenSSL team, triggering ...

Heartbleed bug causes major security headache (Update 3)

April 9, 2014

A confounding computer bug called "Heartbleed" is causing major security headaches across the Internet as websites scramble to fix the problem and Web surfers wonder whether they should change their passwords to prevent theft ...

Software glitch delays 660,000 tax refunds

March 14, 2013

The Internal Revenue Service says 660,000 taxpayers will have their refunds delayed by up to six weeks because of a problem with the software they used to file their tax returns.

Recommended for you

Microsoft aims at Apple with high-end PCs, 3D software

October 26, 2016

Microsoft launched a new consumer offensive Wednesday, unveiling a high-end computer that challenges the Apple iMac along with an updated Windows operating system that showcases three-dimensional content and "mixed reality."

Making it easier to collaborate on code

October 26, 2016

Git is an open-source system with a polarizing reputation among programmers. It's a powerful tool to help developers track changes to code, but many view it as prohibitively difficult to use.

Dutch unveil giant vacuum to clean outside air

October 25, 2016

Dutch inventors Tuesday unveiled what they called the world's first giant outside air vacuum cleaner—a large purifying system intended to filter out toxic tiny particles from the atmosphere surrounding the machine.


Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.