‘Heartbleed’ Vulnerability Plugs Canada Tax Filing Website at Crunch Time

Flaw Plugs Canada Tax Filing Website at Crunch Time

OTTAWA – Canada’s tax agency shuttered its website Wednesday after warning that encrypted taxpayer data could be vulnerable to the “Heartbleed” bug.

The Canada Revenue Agency (CRA) said the decision, which comes only three weeks before the annual income tax filing deadline, was taken as a “preventative” measure.

“The CRA has temporarily shut down public access to our online services to safeguard the integrity of the information we hold,” it said. Canadian taxpayers are expected to file their tax returns for 2013 with the Canadian Revenue Agency by April 30.

Missing the filing deadline usually results in stiff penalties, but the CRA said “consideration” would be given to anyone affected by the website service interruption.

The agency last week said in a Twitter message that it was processing 1,763 online returns per minute — a seasonal high.

As of March 24, 6,787,284 tax returns had been filed with the government agency, it said. Of those, 83.5 percent were filed online.

There are an estimated 22 million taxpayers in Canada.

The freshly-discovered flaw in online-data scrambling software OpenSSL allows hackers to eavesdrop on online communications, steal data, impersonate websites and unlock encrypted data.

OpenSSL is commonly used to protect passwords, credit card numbers and other data coursing through the Internet.

More than half of websites use the software, but not all versions have the same vulnerability, according to heartbleed.com.

Cyber security firm Fox-It estimates that the vulnerability has existed for about two years, since the version of OpenSSL at issue was released.

Computer security specialists, website masters and others began fretting about the bug this week after several reports of hacking.

The CRA said it would investigate any theft and abuse of taxpayer information resulting from security breaches.