The CRA reported the breaches to the privacy commissioner's office in May 2024 and it has been engaging with the tax agency to find out more information about the situation.