Hackers exploited a vulnerability in 2Keys’ multi-factor authentication (MFA) system, used by federal Canadian agencies (CRA, Service Canada, CBSA), to steal 881,000 phone numbers and 85,699 email addresses over a two-week period in August 2023. The stolen data was weaponized in a large-scale phishing campaign, where victims received fraudulent SMS messages mimicking government websites to harvest login credentials. While no additional sensitive data (e.g., financial or PII) was confirmed compromised, the breach enabled credential-theft attempts targeting government service portals. The incident originated from a software vulnerability during a routine update, discovered by 2Keys in mid-August. Authorities stated no fraudulent activity or account takeovers were detected post-breach, but the exposure of contact details at scale posed reputational risks and heightened fraud potential for affected Canadians. The delay in public disclosure (revealed in September) and the reliance on a third-party MFA provider underscored systemic vulnerabilities in government digital infrastructure.