It went badly during the pandemic, didn't it?
According to a CBC/Radio-Canada article, the agency has had to develop a reporting process for these types of privacy breaches since the revelations of recent weeks. I wonder why the CRA hadn't already put this process in place.