The Canada Revenue Agency paid out more than $6 million in fake refunds this tax season after hackers gained access to data used by tax preparation firm H&R Block (NYSE:HRB) Canada, an investigation by CBC has uncovered.
Per CBC’s report, the hackers gained access to hundreds of Canadians’ CRA accounts where they changed direct deposit information and submitted false tax returns to secure millions of dollars of false refunds.
Sources told the publication that the matter prompted the CRA to contact the office of Revenue Minister Marie-Claude Bibeau.
They added that CRA filed to identify the hackers but ruled out the possibility of a breach of its systems or insider involvement.
H&R Block (NYSE:HRB) said in a statement that there is no evidence the breach came from it.
The company said a “comprehensive” internal investigation found none of its data, systems, software and security had been compromised.
It added that it is not aware that Canadian taxpayers impacted by this breach were its clients.
Between 2020 and early October 2024, the CRA said it has mistakenly authorized more than $190 million in payments connected with “confirmed” cases of privacy breaches, CBC reported.
The agency said most of these occurred during 2020, with just $3 million paid out in 2024.
According to sources, the CRA has a backlog of suspicious cases that have not yet been reported as “confirmed” cases, which may explain why this figure is lower than the $6 million paid out to hackers following this year’s H&R Block data breach alone.