Teenager charged in theft of taxpayer data from Canada's revenue agency
900 Canadians had personal numbers needed to work or access benefits stolen
Canadian federal police say they have arrested and charged a 19-year-old man with the theft of 900 taxpayers' data, made vulnerable by the "Heartbleed" bug.
The Royal Canadian Mounted Police (RCMP) said Stephen Arthuro Solis-Reyes was arrested at his London, Ontario home on Tuesday without incident.
"It is believed that Solis-Reyes was able to extract private information held by the CRA by exploiting the security vulnerability known as the Heartbleed Bug," the RCMP said.
The suspect was tracked down within four days after what Canada Revenue Agency Assistant Commissioner Gilles Michaud had described as a serious security breach. Police said computer equipment was seized at the suspect's home and that the investigation was ongoing.
The Canada Revenue Agency said 900 social insurance numbers - personal nine-digit codes required for working or accessing government benefits in Canada - had been stolen last week by "someone exploiting the Heartbleed vulnerability".
Its website was shut down for several days over concerns about the Heartbleed bug. It was rebooted over the weekend after a patch was installed.
The recently discovered flaw in online-data scrambling software OpenSSL allows hackers to eavesdrop on online communications, steal data, impersonate websites and also unlock encrypted data.
OpenSSL is commonly used to protect passwords, credit card numbers and other data sent via the internet. More than half of websites use the software.
Cybersecurity firm Fox-It estimates that the vulnerability has existed for about two years.
