4 day_ago
10
Nurse Leslie Warner volition ne'er hide being taken to her section RCMP detachment successful Fernie, B.C., successful 2022 and charged successful a societal information fraud operating retired of Alberta.
She says she was fingerprinted and had her mug changeable taken.
"I was like: 'Oh my God, this is my individuality theft,'" Warner recalls telling police. "I did not bash this."
The fraud charges were dropped soon aft she explained that an imposter had been utilizing her individuality since 2020, erstwhile idiosyncratic hacked into her Canada Revenue Agency relationship and filed a bogus instrumentality successful Alberta that stated taxation mentation institution H&R Block was her caller "authorized representative."
But Warner had ne'er authorized H&R Block to record her taxes.
Warner said she has been trying for years to recognize however her individuality — and astatine times her beingness — came to beryllium hijacked. She is besides inactive "nervous" astir her CRA relationship being hacked again.
The Fifth Estate has learned that Warner's sanction is 1 of thousands included successful a monolithic breach of employees' idiosyncratic accusation — including societal security numbers — from the British Columbia government's Interior Health authority, which runs hospitals and aesculapian facilities successful the eastbound portion of the province.
While it is unclear however galore of those names were exploited by fraudsters, The Fifth Estate has recovered that stolen identities from respective Interior Health employees — past and contiguous — person been utilized to get bogus CRA refunds and fraudulent loans successful the past respective years.
A erstwhile Ontario privateness commissioner says "it could beryllium a nightmare" for individuals whose names and backstage recognition are included successful the breach.
"This is horrible," said Ann Cavoukian, enforcement manager of the Global Privacy and Security by Design Centre. "These are the things that person to beryllium brought to the public's attention."
'Anonymous' sends Fifth Estate database of stolen identities
A source, identifying themselves lone by the sanction "Anonymous," wrote to The Fifth Estate past period and shared what they said was a database of names stolen from the B.C. authorities agency.
The root said they obtained the database from sellers operating connected the "dark web" who acceptable up a radical connected the encrypted Telegram app successful 2017 and past sold the information for astir $1,000. The Fifth Estate has not independently verified the beingness of the Telegram radical oregon however overmuch the information was sold for.
However, The Fifth Estate has confirmed with galore radical connected the stolen database that they did successful information enactment for B.C.'s Interior Health authority. All of them said that the accusation contained astir them is accurate.
The breach includes societal security numbers, location addresses and commencement dates of much than 28,000 employees who worked astatine the bureau betwixt 2003 and 2009.
"As an ex-criminal who was progressive successful akin activities successful the past, I present privation to assistance others and close my wrongs," Anonymous wrote successful an email to The Fifth Estate. "I judge this accusation could beryllium highly invaluable successful identifying and contacting imaginable and aboriginal fraud victims."
- If you worked astatine B.C.'s Interior Health authorization betwixt 2003 and 2009 and judge you whitethorn beryllium the unfortunate of stolen individuality oregon a hacked CRA account, delight email, successful confidence, [email protected] oregon substance oregon telephone 416-526-4704. Click here to interaction CBC News wholly anonymously utilizing SecureDrop.
In their email to The Fifth Estate, Anonymous said the database was archetypal obtained from a "data leak years ago" and that the accusation "has been sold and distributed to thousands of radical implicit the past 5 to six years." The Fifth Estate has not confirmed however galore radical obtained the data.
Scammers targeted H&R Block offices crossed Alberta
For Warner, the cognition her sanction was connected the database has convinced her this is however her individuality was stolen.
She said she has adjacent much questions present astir however the breach happened, erstwhile it was archetypal detected and however galore different Interior Health employees person had their CRA accounts hacked oregon mightiness successful the future.
"This is happening successful existent time," Warner said, adding she believes determination are "masterminds" moving the schemes who volition proceed "doing this to different people."
A erstwhile Fifth Estate/Radio-Canada probe revealed that tens of thousands of Canadians person had their CRA accounts hacked since 2020 and that scammers person been taking vantage of information gaps betwixt the Canada Revenue Agency and third-party taxation mentation companies.
Special CRA entree codes assigned to third-party taxation mentation companies person been repeatedly exploited by fraudsters to get into Canadians' taxation accounts, The Fifth Estate learned.
The Fifth Estate reported successful March that 2 taxpayers successful B.C., 1 from Creston and 1 from Kelowna, had their accounts hacked successful 2023 and bogus returns filed successful their names by imposters who had targeted H&R Block locations successful Alberta.
It turns retired that some their names are besides connected the database of Interior Health employees precocious leaked to The Fifth Estate. Like Warner, the Kelowna unfortunate is besides a nurse.
Now, caller documents and interviews with much stolen individuality victims person revealed that astatine slightest six radical who worked for Interior Health successful B.C. had their CRA accounts hacked by imposters utilizing assorted H&R Block locations crossed Alberta.
A seventh stolen individuality victim, a caregiver from Penticton, was listed by imposters arsenic the sole manager of 2 federally registered ammunition companies successful Edmonton. Fraudsters past utilized those fake companies successful her sanction to nutrient the bogus T4 slips utilized successful their taxation frauds.
"I consciousness soiled having been a unfortunate of this," said the nurse, who did not privation her sanction utilized publically to support her privacy, erstwhile contacted by The Fifth Estate.
Those 7 victims' names — and backstage recognition — each amusement up successful the leaked database of Interior Health authorization employees that was sent to The Fifth Estate.
Warner's ordeal began erstwhile she checked her CRA relationship successful 2021 and realized an imposter had received a bogus taxation refund successful her name, aft utilizing her societal security fig and changing her email code and her nonstop deposit accusation to a slope relationship with Digital Commerce Bank successful Calgary.
And she had noticed she had 3 caller authorized representatives:
- H&R BLOCK (OFFICE 50575).
- H&R BLOCK (50638).
- H&R BLOCK CANADA, INC.
"I started looking done — my code had changed, my telephone fig had been changed. Suddenly I had children."
Warner besides noticed that the CRA sent a missive to the attraction of an H&R Block taxation preparer successful Edmonton successful March 2021, stating that helium was Warner's "authorized interaction for physics filing." The pursuing period records amusement the CRA sent a missive successful her sanction to H&R Block's office successful Calgary.
Warner was surviving and moving successful B.C. passim that full period.
Internal memos uncover H&R Block alert of fraudsters
In an email to The Fifth Estate past November, H&R Block stated it did not cognize of "any incidents" wherever Canadians had their CRA accounts hacked done the unauthorized usage of its "EFILE credentials" — those peculiar entree codes that let 3rd parties to record returns connected behalf of customers.
Still, interior H&R Block messages obtained by The Fifth Estate show that the institution was alert that fraudsters were using their offices to record mendacious returns.
An undated H&R Block memo labelled "Out-of-Province Tax Filers" states that: "We person seen an summation successful fraud by radical claiming to determination from British Columbia to Alberta."
Another announcement to employees, dated April 14, 2022, stated that H&R Block has "seen fraudulent cases successful Edmonton and Calgary" of bogus T4 slips from a fake institution called "Hawt shotz Deliveries Inc."
The pursuing year, connected June 15, 2023, an "updated" memo stated that "there are presently 2 fraudsters" trying to usage bogus T4 slips from a numbered institution successful Edmonton. Imposters, the memo stated, tried unsuccessfully to get instant refunds astatine H&R Block locations successful Red Deer and Edmonton.
The Fifth Estate reported past period that imposters utilized a fake T4 gaffe from that aforesaid numbered institution to get an instant refund done an H&R Block bureau successful Alberta, aft successfully hacking into the CRA relationship of the erstwhile Interior Health worker surviving successful Creston, B.C.
The interior H&R Block memo besides warns that scammers appeared to beryllium utilizing fake IDs and the "stolen identity" of 2 much radical whose names besides amusement up successful the leaked database from B.C.'s Interior Health authority.
One H&R Block employee, who says office instructed its workforce this twelvemonth not to speech to reporters, told The Fifth Estate they judge the taxation mentation company's main interest was "not losing money" alternatively than pursuing the fraudsters.
In a connection Friday, H&R Block said its erstwhile connection astir not knowing of immoderate Canadians being affected by unauthorized usage of its EFILE credentials is accurate.
"What you are referring to is simply a substance of individuality theft and unrelated to EFILE credentials," H&R Block said.
"It is misleading and irresponsible to marque immoderate assumptions astir the circumstances relating to immoderate fraudulent taxation filing incident, and to marque assertions astir a specific party's eventual work for it," reads the statement.
H&R Block did not specifically code however imposters were capable to successfully usage H&R Block offices to process the bogus returns and hack into CRA accounts.
Interior Health alerted to stolen names past March
In March 2024, B.C.'s Interior Health Authority issued a media merchandise that immoderate employees' idiosyncratic accusation had been recovered during an RCMP probe and asked anyone who had worked for the bureau betwixt 2003 and 2009 to telephone a 1-800 fig to spot if their sanction was connected the list.
Several employees whose names, addresses, dates of commencement and societal security numbers amusement up connected the database provided to The Fifth Estate say the wellness bureau told them they were not connected the list.
Interior Health has said the database the RCMP recovered contained 20,000 names. The database provided to The Fifth Estate contains 28,000 names.
In its media merchandise past year, Interior Health said it had hired "external information experts" from audit and consulting steadfast Deloitte Canada who "confirmed that this accusation is not connected the acheronian web."
The acheronian web is often utilized by transgression networks to bargain and merchantability stolen information.
In their email, Anonymous told The Fifth Estate that they learned astir the stolen information connected the acheronian web and immoderate connection to the contrary "is untrue."
"Me personally, arsenic good arsenic others, person bought it connected Telegram shops, and different acheronian web forums," Anonymous wrote. "I'm definite [Interior Health] released that connection arsenic a extortion from liability and enactment similar it's not that large of a leak."
Information connected the acheronian web tin travel and spell implicit time.
WATCH | Could CRA deals with taxation companies beryllium partially to blasted for accounts being hacked? 
Deloitte declined to reply questions astir how, oregon when, it mightiness person determined thing was not connected the acheronian web, citing lawsuit confidentiality.
In a statement, Interior Health's vice-president of integer health, Brent Kruschel, wrote that "due to the property of the information and its wide scope, IH was not capable to accurately corroborate wherever the accusation came from."
"As this remains an progressive RCMP probe and earlier the courts, Interior Health is not capable to supply further information," helium said.
For her part, Warner said she does not privation to constituent fingers but astatine the criminals who stole her identity. She simply has much questions — astir who knew what and erstwhile and wherefore she wasn't told earlier.
"Why didn't anyone get ahold of me?"
Please interaction [email protected] oregon substance oregon telephone 416-526-4704 if you are the unfortunate of a hacked CRA account.
English (CA) · 
English (US) · 
Spanish (MX) · 
French (CA) ·