The Canada Revenue Agency and a popular British parenting website lost user data after attackers exploited the Heartbleed SSL vulnerability.
The websites of the above organizations are believed to be among the first to make announcements confirming data loss as a result of the Heartbleed, which was first disclosed last Tuesday. The flaw existed in Open SSL, a cryptography library used by thousands of websites to enable encryption and was quickly highlighted as one of the most serious vulnerabilities in recent years.
The Canada Revenue Agency (CRA) blocked public access to its online services last Tuesday, but that wasn’t fast enough to stop hackers from stealing information, it said on its website. “Unfortunately, the CRA has been notified by leading government security agencies that it was the victim of a malicious breach of taxpayer data that occurred over a six-hour period across Canada. Based on our analysis to date, the Social Security Numbers of approximately 900 taxpayers were removed from CRA systems by someone exploiting the Heartbleed vulnerability.”
