The Heartbleed bug was made public a week ago by Google and Codenomicon, a small Finnish security firm, which independently identified the problem.
The bug exploits a flaw in OpenSSL - a cryptographic software library used by services to keep data transmissions private.
Canada's tax agency was one of the first major organisations to cut services as a result the security flaw.
However, the action came too late.
"It is believed that [Mr] Solis-Reyes was able to extract private information held by CRA by exploiting the vulnerability known as the Heartbleed bug," the RCMP said in a statement, external.
The RCMP, which has been investigating the breach for four days, charged Mr Solis-Reyes with "unauthorized use of a computer" and "mischief in relation to data".
He is expected to appear in court on 17 July 2014.
Security experts warn that more attacks could be revealed soon, as firms and governments work to determine whether or not their systems are vulnerable.