Heartbleed bug: Canada Revenue Agency and Mumsnet hit by internet vulnerability

The Canadian tax authority and leading UK website for parents Mumsnet have both announced they have had data stolen by hackers exploiting the Heartbleed bug.

Mumsnet – which says it has 1.5 million registered members – said that it believed that the cyber thieves may have obtained passwords and personal messages before it patched its site.

The Canada Revenue Agency said that 900 people’s social insurance numbers had been stolen.

These are the first confirmed losses.

The Mumsnet said that user data was at risk when her own username and password were used to post a message online.

The site added that it was forcing its members to reset any password created on or before Saturday.

Canada’s tax agency was one of the first major organizations to cut services as a result of the flaw in OpenSSL – a cryptographic software library used by services to keep data transmissions private.

However, its action last Tuesday appears to have come too late.

“Regrettably, the CRA has been notified by the Government of Canada’s lead security agencies of a malicious breach of taxpayer data that occurred over a six-hour period,” the agency said on a message posted to its homepage.

“Based on our analysis to date, social insurance numbers (SIN) of approximately 900 taxpayers were removed from CRA systems by someone exploiting the Heartbleed vulnerability.”

“We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed.”

The Heartbleed bug was made public a week ago by Google and Codenomicon, a small Finnish security firm, which independently identified the problem.

OpenSSL is used to digitally scramble data as it passes between a user’s device and an online service in order to prevent others eavesdropping on the information.

It is used by many, but not all, sites that show a little padlock and use a web address beginning “https”.

The researchers discovered that because of a coding mishap hackers could theoretically access 64 kilobytes of unencrypted data from the working memory of systems using vulnerable versions of OpenSSL.

Although that is a relatively small amount, the attackers can repeat the process to increase their haul.

Mumsnet has been criticized for one aspect of its handling of the breach – its email to members contains an inline link that it suggests they click to reset their passwords.

By contrast Canada’s tax agency said it would not call or email the individuals it believed to be affected by its breach in order to avoid giving criminals a chance to exploit the situation.

Instead it said it would send out registered letters.