Canada Revenue Agency Reports Over 42,000 Breaches Since 2020, Accepts Most Privacy Commissioner Recommendations

More than 42,000 breaches have occurred at the Canada Revenue Agency since 2020, each involving unauthorized access to or modification of taxpayer information, according to a special report tabled in Parliament on Thursday. Privacy Commissioner Philippe Dufresne pointed to gaps in the agency's prevention, monitoring, detection and handling of breaches.

The report, posted online on May 07, 2026, found the Canada Revenue Agency could not provide details of every confirmed breach because of limitations in its tracking systems and the sheer volume of incidents.

The commissioner's office determined the agency did not implement mandatory multi-factor authentication in a timely manner. It also did not consistently rely on methods considered to be best practices for account security. The Canada Revenue Agency could not always adequately explain how attackers managed to bypass authentication processes.

Cbc reported that these shortcomings persisted even as the number of breaches climbed above 42,000. Dufresne made nine recommendations for improvement. The agency accepted eight in full and one in part.

The special report was tabled in Parliament by Privacy Commissioner Philippe Dufresne. Jim Bronskill authored the article for The Canadian Press that detailed the findings on the same day the document was posted online.

His office obtained the breach figures directly from the Canada Revenue Agency, which acknowledged shortfalls in its own systems while agreeing to most of the proposed changes. The breaches resulted from people gaining unauthorized access to or modifying taxpayer information.

Cbc reported the watchdog's conclusion that the agency's response fell short of standards expected for safeguarding millions of Canadian tax accounts.