Feds Scramble After Interac’s 2Keys Hack Exposes Canadians to Phishing

Almost one million Canadians had their contact information stolen in a cyberattack on the federal government’s authentication system, later used in a massive phishing campaign.

According to Employment and Social Development Canada (ESDC), hackers accessed about 881,000 phone numbers tied to the Canada Revenue Agency’s MyCRA service, as well as more than 85,000 email addresses connected to Canada Border Services Agency accounts.

The breach was first revealed in early September by the Chief Information Officer, who described it as a “data security incident” involving the government’s multi-factor authentication provider. At the time, officials stressed that only email addresses and phone numbers were taken, calling it a “non-material privacy incident.”

But the scale of the theft was not disclosed until now. Criminals used the stolen data to send hundreds of thousands of text messages, many containing links to a fake Government of Canada website. Clicking those links could trick victims into handing over login details for real federal portals.

“The (malicious) actor sent spam text messages containing a link to a fraudulent phishing website designed to look like a Government of Canada website to some of these phone numbers,” the CIO’s office said.

So far, Ottawa says there’s no evidence of compromised accounts. “The data accessed did not include any additional personal identifiable information or sensitive personal data,” said ESDC spokesperson Mila Roy to the National Post. “This information alone does not allow the unauthorized individual(s) to access Government of Canada accounts or other personal information.”

The feds confirmed that hackers exploited a flaw introduced during a routine software update by Interac-owned 2Keys, its multi-factor authentication provider, between August 3 and 15, 2025. The vulnerability allowed attackers to steal nearly 881,000 phone numbers tied to CRA and ESDC accounts and more than 85,000 email addresses linked to CBSA accounts. Interac is jointly owned by the country’s biggest banks and credit unions, with the biggest shareholders being RBC, TD, Scotiabank, BMO, and CIBC.

Criminals then used that data to send phishing texts directing people to a fake Government of Canada website designed to steal login credentials. Interac said it detected “unusual behaviour,” informed Ottawa within two days, and patched the system. Officials insist no other sensitive personal information was exposed, calling the incident a “non-material privacy incident,” though the stolen data was actively weaponized in a spam campaign.

Within two days 2Keys informed Ottawa of unauthorized access, said Interac spokesperson Cillian Murphy to the National Post, noting the company “promptly informed the government and launched an investigation.”

Did you receive any spam texts claiming to be from the federal government in the past month?