Tens of thousands of taxpayer accounts hacked as CRA repeatedly paid out millions in bogus refunds

At the height of this year's tax season, the Canada Revenue Agency discovered that hackers had obtained confidential data used by one of the country's largest tax preparation firms, H&R Block Canada.

Imposters used the company's confidential credentials to get unauthorized access into hundreds of Canadians' personal CRA accounts, change direct deposit information, submit false returns and pocket more than $6 million in bogus refunds from the public purse, an investigation by CBC's The Fifth Estate and Radio-Canada has found.

In one case, the hackers filed a return with a legitimate postal code, but a fake address on a non-existent Tomato Street.

"Obviously the door is open and some people are infiltrating the system," André Lareau, an associate tax professor at Laval University in Quebec City, said in an interview. "But the CRA does not seem to have found the key to lock the door."

According to sources, the crisis prompted the CRA to contact the office of Revenue Minister Marie-Claude Bibeau.

The agency prepared media lines to respond to inquiries should there be questions about the breach of H&R Block data and why the agency paid out millions to scammers.

In the end, the public was never alerted to the scheme.

Bibeau declined The Fifth Estate/Radio-Canada's request for an interview.

In a statement, H&R Block said there is no evidence the breach came from it.

The tax firm said a "comprehensive internal investigation" concluded none of its "data, systems, software and security" had been compromised. H&R Block said it is not aware that the Canadian taxpayers impacted by the breach were any of its own clients.

According to sources, the CRA failed to identify the hackers, but ruled out the possibility of a breach of its own systems or insider involvement. Ultimately, who hacked that data and where from remains unknown.

Both the revenue minister and CRA's media relations office did not respond to questions about the H&R Block data breach.

The Fifth Estate and Radio-Canada are not identifying the sources because they are not authorized to speak publicly.

The investigation by The Fifth Estate and Radio-Canada has found that the H&R Block data breach is just one example of many that are overwhelming the CRA, as auditors and investigators worry the public might lose trust in the agency tasked with safeguarding its taxpayer dollars and personal information.