Hackers exploited a vulnerability in 2Keys' multi-factor authentication (MFA) software, used by federal government agencies like the Canada Revenue Agency (CRA), Service Canada, and Canada Border Services Agency (CBSA). The breach occurred over a two-week period starting August 3, 2023, during a routine software update. Attackers stole 881,000 phone numbers (CRA users) and 85,699 email addresses (CBSA account holders). While the stolen data was classified as 'low-risk' (no sensitive PII or financial data was exposed), criminals leveraged it to launch a large-scale phishing campaign, sending fraudulent SMS messages with links to spoofed government websites. The goal was to trick victims into surrendering login credentials, potentially granting access to sensitive accounts. Though no fraudulent activity or account compromises were detected post-breach, the incident exposed systemic risks in third-party authentication providers. The delay in public disclosure (detected mid-August, revealed September 9) and the sheer scale of affected users—nearly 1 million Canadians—highlighted vulnerabilities in critical government-facing infrastructure.