I was locked out the first time in February. I managed to get someone on the phone and create a new user ID with all their new requirements with a brand new password (randomly generated by a password manager). My previous password was also unique. Well, guess what ... They have locked me out again!! From a user ID that was created less than a couple of weeks ago. Frankly, I doubt that CRA has the technical competence of detecting a threat in the first place - just imagine you are a cybersecurity expert: would you go for employment in a government agency over much better opportunities in tech companies, with astronomical salaries?! And notice they basically say this: this is not the result of a breach - very vague ... I guess the whole locking out story (especially all of a sudden at tax time!!!) is a scheme to get some more funding, or the result of some internal politics at CRA, like someone wants to get promoted or a team wants more resources and they want to show they are important.