When everyone was left scrambling last week to change their passwords after Heartbleed was discovered, many websites had to update their security in order to fix the problem — and those that didn't left themselves vulnerable.

One 19-year-old Canadian took advantage of Heartbleed and hacked into the country's tax agency website. The hacker, Arthuro Solis-Reyes, was arrested at his home in Ontario by Canadian authorities, who seized his computer equipment for evidence. Reyes is accused of using Heartbleed to make his way into the Canadian Revenue Agency's database (their version of the IRS) and stealing 900 social security numbers, among other information. “We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed,” the agency said. Because of him, Canada moved their tax day deadline from April 30 to May 5.

[via Fortune]