GCKey and CRA accounts taken over by credential stuffing

Usernames and passwords of 9,041 GCKey accounts, used to sign in to federal services, obtained with passwords reused from other breaches; about a third were used to reach government services. About 5,500 Canada Revenue Agency accounts were also targeted. The affected accounts were cancelled.