Canada

Great. Good thing (?) I didn't unlock my account after the last breach because I never have 3 hours to do nothing while I wait on hold with CRA support.

We really need to get rid of SIN numbers.

They should be cryptographically signed tokens you request for a single individual service, with a defined scope of access.

E.g. when you want to set up payroll tax at a new job, you go online or visit service canada, register a token, and share that with your employer.

When you're authorizing H&R Block to do you taxes, you request a tax token for the current year.

When you're opening a bank account you request a token and the bank verifies it.

When these leak they are easily reset, and when credit bureaus need access to your history for a hard check, they request a token with that permission.

This is kind of a pain but it means the office administrator can't open a credit card in your name just because they have your info, and a leak at H&R Block gives a specific scope of investigation and resolution.

Your account can still be breached, buy that has a clear resolution step (verify your identity with service Ontario or Canada Post, invalidate tokens, file an investigation, and submit new tokens).

People affected:

If you worked at B.C.'s Interior Health authority between 2003 and 2009 and believe you may be the victim of stolen identity or a hacked CRA account, please email, in confidence, harvey.cashore@cbc.ca or text or call 416-526-4704. Click here to contact CBC News completely anonymously using SecureDrop.