Question Period Note: DATA BREACHES AND Identity Theft involving the SOCIAL INSURANCE NUMBER (sin)

Employment and Social Development Canada’s (ESDC) efforts to protect Canadians' personal information in in light of external data breaches and identity theft involving the Social Insurance Number (SIN).

The Department is committed to protecting the privacy and integrity of the personal data it collects and retains. This is done through strong and well-established policies and procedures that are constantly reviewed and reinforced.

Employment and Social Development Canada (ESDC) has a robust counter-fraud program that prevents and detects potentially fraudulent activities while safeguarding public funds and protecting Canadians.

At any time, Canadians can call Service Canada or visit a Service Canada centre for guidance about SIN fraud. Officials will review the information and help Canadians mitigate the risks of fraud.

In proven cases of fraud or identity theft, the Department works closely with the victims to determine the best course of action to prevent further fraudulent activity, including the issuance of a new SIN if necessary.

These measures help protect benefits for those who need them and contribute to upholding public trust in social programs.

Introduced in 1964, the SIN is a nine-digit number used as a file number for a variety of GoC programs and benefits. It is not an identity document or piece of identification. The SIN plays a vital role in the sound management of many programs and services across the federal government. This includes ensuring that Canadians’ accounts are accurately identified and sharing data for administration purposes.

The SIN Program processed over 2.6 million SIN transactions in fiscal year 2024-2025, including the issuance of over 1.3 million first time SINs, changes to the SIN record such as name changes, renewals, and requests for replacement or confirmations of SIN.

Replacement SINs are only issued in cases of proven fraud. This policy is maintained because obtaining a new SINis complex. It requires an individual to update their SIN with their financial institutions and employers, to monitor two SINs instead of one, and does not protect the individual from fraud given that the old SIN will always exist and remain associated to them. The number of Canadians who have had their SIN replaced by Service Canada due to fraud-related reasons has remained relatively stable at approximately 6 per year since 2021.

Providing a SIN is not legally required for:

Proving identity;

Completing a job application;

Completing an application to rent property;

Completing a credit-card application or banking transactions (line of credit, loan);

Writing a will; and,

Applying to a university or college.

Although this practice is unauthorized, it is not prohibited for private-sector organizations to ask for a SIN.

Below are the steps required when someone is facing identity theft involving the Social Insurance Number (SIN) (from the Website):

Canadians may be at risk of fraud and identity theft if the SIN becomes breached or compromised. It is important to detect and report potential identity fraud as soon as possible to reduce risk of harm. Signs of unauthorized use include unfamiliar credit report inquiries, unfamiliar records of employment on My Service Canada Account (MCSA) and receiving a Notice of Reassessment from the Canada Revenue Agency for undeclared earnings.

If the SIN was exposed in a data breach, the client must closely monitor their personal and financial information for any unauthorized use. Key areas to monitor include credit reports from Equifax and TransUnion, Canada’s two national credit bureaus, financial statements, and suspicious incidents related to mail.

If fraud has taken place, the client must:

Contact local police to file a complaint. The client must ask for a reference number and the name of the assisting officer;

Contact the Canadian Anti-Fraud Call Centre at 1-888-495-8501 for advice and help with identity theft;

Contact Equifax and TransUnion to review their credit report for suspicious activity and add a fraud alert to their credit file. This will instruct creditors to contact the client before opening new accounts in their name;

Contact their bank and creditors;

Report mail irregularities like opened envelopes and missing financial statements to Canada Post (1-866-607-6301); and,

If the SIN has been used fraudulently to obtain money from the government, report the fraud directly to the affected program (e.g., Employment Insurance Program) to stop fraudulent payments.

In May 2025, a bot attack targeted the Employment Insurance Program. Over a number of days, bad actors attempted to gain access to Employment Insurance benefits and My Service Canada accounts:

Most of these attempts (over 99%) were quickly detected and stopped by our detection measures before any payments were made;

ESDC deployed strong counter-fraud measures and worked diligently to prevent personal information in the public domain from being exploited by bad actors. ESDC was able to stop the threat; and

ESDC works collaboratively with its security partners, the Treasury Board Secretariat, the CRA and other federal departments to protect the personal information of Canadians.

The Canadian Anti-Fraud Centre estimates that victims of fraud and cybercrime in Canada lost more than $638 million in 2024. Among the various types of fraud, identity fraud accounted for the highest number of victims. Moreover, studies reveal that only 5-10% of incidents are formally reported.

Privacy breaches can involve sensitive personal information, including an individual’s Social Insurance Number.

Canadians are facing increasingly sophisticated threats to their identity as personal information is used across a growing number of online services.

The Government of Canada takes the protection of Canadians’ personal information very seriously. ESDC frequently updates its website to help Canadians understand how to protect their SIN, who can ask for the SIN, and what steps to take when they suspect that their SIN is being used fraudulently.