{"id":181492,"date":"2025-09-09T15:00:00","date_gmt":"2025-09-09T19:00:00","guid":{"rendered":"https:\/\/www.interac.ca\/?post_type=content&p=181492"},"modified":"2025-12-03T10:02:41","modified_gmt":"2025-12-03T15:02:41","slug":"a-statement-regarding-2keys-corporation-notice-of-non-material-privacy-incident-involving-non-sensitive-personal-information","status":"publish","type":"content","link":"https:\/\/www.interac.ca\/en\/content\/news\/a-statement-regarding-2keys-corporation-notice-of-non-material-privacy-incident-involving-non-sensitive-personal-information\/","title":{"rendered":"A statement regarding 2Keys Corporation: Notice of Non-Material Privacy Incident Involving Non-Sensitive Personal Information"},"content":{"rendered":"\n
\"\"<\/figure>
\n

A statement regarding 2Keys Corporation, a subsidiary of Interac Corp.<\/strong><\/em><\/strong><\/em><\/p>\n<\/div><\/div>\n\n\n\n

<\/p>\n\n\n\n

September 9, 2025 \u2013 Ottawa, Ontario \u2013 Treasury Board of Canada Secretariat<\/p>\n\n\n\n

From: <\/strong>Treasury Board of Canada Secretariat<\/a><\/p>\n\n\n\n

Statement<\/strong><\/strong><\/p>\n\n\n\n

On August 17, 2025, the Government of Canada was alerted to a cyber incident impacting a third party service provider\u2019s multi-factor authentication (MFA) application interface used for Canada Revenue Agency (CRA), Employment and Social Development Canada (ESDC) and Canada Border Services Agency (CBSA) user accounts. The provider, 2Keys Corporation, discovered the incident, promptly informed the government and launched an investigation.<\/p>\n\n\n\n

A routine software update resulted in a vulnerability that allowed a malicious actor to access phone numbers associated with CRA and ESDC accounts and email addresses associated with CBSA accounts of individuals who have used the MFA service between August 3 and August 15. During this period, the actor sent spam text messages containing a link to a fraudulent phishing website designed to look like a Government of Canada website to some of these phone numbers. There was no impact to CBSA portal users who were accessing their account via email.<\/p>\n\n\n\n

2Keys Corporation promptly addressed the software vulnerability and the MFA service has been restored. The 2Keys Corporation investigation, which is being conducted with the help of external cybersecurity experts, confirmed that the breach was limited to phone numbers and email addresses. At this time, there is no indication that any additional personal identifiable information or sensitive personal data was disclosed, and it has been determined that this is a non-material privacy incident<\/a>.<\/p>\n\n\n\n

Users of Government of Canada online services should be vigilant if they receive unexpected messages alleging to originate from the government. As a general reminder:<\/p>\n\n\n\n