The Crime Stoppers, PHP and Other Hacks:  Could it Happen to You?

Evelyn Jacks

October is Cyber Month and it is coming to a close quickly with no shortage of scary cyber security issues in play. Just this week the Office of the Privacy Commissioner of Canada (OPC), opened an investigation into Navigate360, related to a cybersecurity incident involving tips to Crime Stoppers.  This comes on the heels on the PHP hack on October 21, where underlying code flaws, which had sat dormant over a decade, were exposed thanks to AI, affecting over 70% of the internet.  It’s a new frontier, especially if you are using third party software.  The government is taking some action on guidance to protect yourself and your clients.  You may wish to review and comment before December 4.

The Backdrop.  If you are in even the smallest business, you’ll want to take special note of the responsibilities you have relating to your clients’ information.  The OPC notes the following:

“Organizations are responsible for the personal information – defined as information about an identifiable individual – that is under their control. This includes data that is collected by a third party on their behalf or transferred to a third party for processing.”

To help businesses subject to Canada’s Privacy Law, the Personal Information Protection and Electronic Documents Act, or PIPEDA, assess third-party service provider approaches to privacy before beginning to work with them, the OPC has produced a guidance document.  This is what the government is accepting comments on, until December 4, 2026.   You may wish to check this out. Your comments can be sent by email to cpvp-opcconsultation1@priv.gc.ca.

The guidance document, according to the OPC, “outlines best practices to help organizations identify privacy and compliance risks; make decisions about whether to work with a particular provider; inform contractual terms with third parties; and demonstrate accountability to regulatory bodies.”

Meanwhile, the Privacy Commissioner has announced this week it will examine the security safeguards that Navigate360 had in place at the time of the Crime Stoppers breach to determine the organization’s compliance with Canada’s federal private-sector privacy law. But is this enough, soon enough? 

How Bad Is it Out There?  Looking at the OPC site, there is significant activity.  The office itself has been presenting weekly news releases on cyber security issues.

According to the inaugural The Cybersecurity Canada Report 2026, updated October 16, 2026.  Quoting from the report:

• “Canadians lost a record CA$704 million to fraud in 2025, according to the Canadian Anti-Fraud Centre's 2025 annual statistics, released March 2026.  This is the highest annual fraud loss on file, with investment fraud, romance scams, and job scams leading by dollar value.
• Identity is now the breach surface. Sophos's 2026 State of Identity Security finds 71% of organizations suffered an identity-related breach in the past year; its Active Adversary Report 2026 finds 67% of all investigated incidents in 2025 were rooted in identity attacks. 
• The threat landscape now moves in seconds, not hours or days. Mandiant's M-Trends 2026 reports the median time between initial access and handoff to a secondary threat group has collapsed from 8+ hours in 2022 to 22 seconds in 2025. CrowdStrike's 2026 Global Threat Report finds the average eCrime breakout time fell to 29 minutes, fastest observed at 27 seconds. There is no human-paced response time that fits inside that window; what matters is automated detection and pre-emptive control.”

Meanwhile, the Canadian Survey of Cyber Security and Cybercrime (CSCSC) reports that 15% of Canadian businesses were impacted by cyber security incidents in 2025. Let’s look at the likelihood:

• Larger businesses were targeted more frequently (25%) vs small businesses (15%).  If there’s a silver lining behind this cloud it’s that the numbers are down from 2019 when the overall figure was roughly 21% of businesses which were impacted.
• When a large company’s security is breached, it can impact your clients too. Loblaw is in the process of notifying about two million of its customers whose personal information may have been leaked in a data breach in March, for example.
• While 86% of businesses in Canada report using some sort of cyber security measures, that means that about 14% have left themselves wide open. As tax professionals you are almost certain to be among the 86% but it’s worth checking with your business clients to see if they are as well.
• Your large business clients are more likely to use AI-based cyber security tools (46%) but the overall rate is about 11%. 

The PHP Hack: Because of the recent PHP hack, businesses need to be more alert than ever of the possibility of a cyber attack. PHP is used by many websites as a security tool but was recently found to be vulnerable to cyber attack.

While the hole in the system was plugged quickly, it did result in government websites in Canada, France and Japan, going dark temporarily. Businesses and other organizations which use PHP will be responsible for implementing the fix themselves.

The CRA Class Action Suit: Your individual clients are also susceptible to hacks in dealing with CRA – which they are required to do. The class action suit regarding the hack into CRA is ongoing. Your clients who were impacted can sign up until February 3, 2027 through the administrator portal at  KPMG Settlement Eligibility Check or Breach Settlement Canada. This site should tell your clients if they are eligible to be a member.

Clients whose information was accessed but where no fraud was found can claim only up to $80. If the personal information was found to have been used fraudulently the claim can go up to $200 and up to $5,000 if your client has documented out of pocket identity theft expenses.  For more information, refer back to the October 7th edition of the Knowledge Bureau Report. 

The Readiness Gap.  Cybersecurity Canada notes that in the most recent Statistics Canada national figures only 26% of Canadian businesses had written cybersecurity policies in place. It appears that the widest gap is amongst the smallest businesses:   only 15.4% of small businesses (10 to 49 employees) had a written policy to manage internal cyber security risks in 2023, compared with 66.3% of large businesses, according to Statistics Canada table 22-10-0130-01.

The Bottom Line: With October being Cyber Month, the CRA has published a lengthy list of possible scams and frauds which individuals and businesses alike need to watch for.   It also has outlined how it is dealing with its security measures.  It also provides information on how it secures compromised accounts, which you should also review.

Something simple:  reminding your clients to change their passwords frequently and to not use the same password for all their accounts is a basic service to them and a good way to start a valuable discussion.  Also, reviewing your engagement letter and disclaimers in advance of tax season is recommended, to mitigate losses that may be coming in the next cyber attack.   

Additional Educational Resources:   invite your clients to listen to Real Tax News with Evelyn Jacks and Friends to understand their tax system better. This is available anywhere you listen to your favorite podcasts or go to learn.knowledgebureau.com/courses/real-tax-news-podcast