Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Canada Police Nab Young Man in Heartbleed Data Theft

OTTAWA – Federal police said Wednesday they have arrested and charged a 19-year-old man in the theft of 900 Canadian taxpayers’ data, which was made vulnerable by the “Heartbleed” bug.

OTTAWA – Federal police said Wednesday they have arrested and charged a 19-year-old man in the theft of 900 Canadian taxpayers’ data, which was made vulnerable by the “Heartbleed” bug.

The Royal Canadian Mounted Police (RCMP) said Stephen Arthuro Solis-Reyes was arrested at his London, Ontario home on Tuesday without incident.

He is scheduled to appear in court on Thursday to face charges of mischief and unauthorized use of a computer to steal data from the Canada Revenue Agency (CRA)’s website.

“It is believed that Solis-Reyes was able to extract private information held by the CRA by exploiting the security vulnerability known as the Heartbleed Bug,” the RCMP said in a statement.

The suspect was tracked down within four days after what CRA Assistant Commissioner Gilles Michaud had described as a serious security breach.

Police said computer equipment was seized at the suspect’s home, and that the investigation is still ongoing.

The Canada Revenue Agency said 900 social insurance numbers — personal nine-digit codes required for working or accessing government benefits in Canada — had been stolen last week by “someone exploiting the Heartbleed vulnerability.”

Its website was shuttered for several days over concerns about the Heartbleed bug.

It was rebooted over the weekend after a patch was installed.

The recently-discovered flaw in online-data scrambling software OpenSSL allows hackers to eavesdrop on online communications, steal data, impersonate websites and unlock encrypted data.

OpenSSL is commonly used to protect passwords, credit card numbers and other data sent via the Internet.

More than half of websites use the software, but not all versions have the same vulnerability, according to heartbleed.com.

Cybersecurity firm Fox-It estimates that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.

Written By

AFP 2023

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Ransomware

US government reminds the public that a reward of up to $10 million is offered for information on cybercriminals, including members of the Hive...

Ransomware

The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.