Teen Charged in Heartbleed Breach

Allegedly Stole Data from Canada Revenue Agency
Teen Charged in Heartbleed Breach

The Royal Canadian Mounted Police have arrested a 19-year-old London, Ontario, man for his alleged role in exploiting the Heartbleed vulnerability to steal data from the Canada Revenue Agency website.

See Also: Deception-Based Threat Detection: Shifting Power to the Defenders

Stephen Arthuro Solis-Reyes was arrested at his residence on April 15 and faces charges of unauthorized use of a computer and criminal mischief, police say in an April 16 statement.

"The RCMP treated this breach of security as a high priority case and mobilized the necessary resources to resolve the matter as quickly as possible," says Gilles Michaud, assistant RCMP commissioner. "Investigators from national division, along with our counterparts ... have been working tirelessly over the last four days analyzing data, following leads, conducting interviews, obtaining and executing legal authorizations and liaising with our partners."

The suspect's computer equipment was seized during the arrest, authorities say. Solis-Reyes is scheduled to appear in court on July 17.

Breach Details

The Canada Revenue Agency reported on April 14 that 900 taxpayers had their Social Insurance numbers compromised in a breach stemming from a cyber-attacker exploiting the Heartbleed vulnerability in agency systems (see: Heartbleed Causes Breach in Canada).

"We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed," Commissioner Andrew Treusch said in a statement. "Thanks to the dedicated support of Shared Services Canada and our security partners, the agency was able to contain the infiltration. Further, analysis to date indicates no other CRA infiltrations have occurred either before or after this breach."

In another breach involving Heartbleed, Mumsnet, a UK website for parents, forced all of its users to change their passwords after it discovered that a cyber-attacker had used the vulnerability to access data from users' accounts (see: Heartbleed Breach Reported in UK).

Heartbleed exposes a flaw in OpenSSL, a cryptographic tool that provides communication security and privacy over the Internet for applications such as Web, e-mail, instant messaging and some virtual private networks (see: Heartbleed Bug: What You Need to Know).


About the Author

Jeffrey Roman

Jeffrey Roman

News Writer, ISMG

Roman is the former News Writer for Information Security Media Group. Having worked for multiple publications at The College of New Jersey, including the College's newspaper "The Signal" and alumni magazine, Roman has experience in journalism, copy editing and communications.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing govinfosecurity.com, you agree to our use of cookies.