You Could Be Owed Up to $5,000: The CRA Data Breach Settlement, Explained

 

August 21, 2026

If you had a Government of Canada online account back in 2020, it's worth five minutes to check whether you're eligible for a payout.

Claims are now open in an $8.7-million federal settlement tied to a wave of 2020 cyberattacks on Canada Revenue Agency and other Government of Canada accounts. If your CRA My Account, My Service Canada Account, or another GCKey-linked account was compromised, you may be entitled to compensation — in some cases, up to $5,000.

Here's what happened, who qualifies, and exactly how to file before the deadline.

What happened

Between June and August 2020, hackers used "credential stuffing" — testing stolen usernames and passwords from other data leaks against government login pages — to break into thousands of Government of Canada online accounts. In some cases, attackers viewed confidential personal and financial information; in others, they used stolen access to file fraudulent claims for pandemic-era benefits like CERB and CESB in victims' names.

A class action, Sweet v. His Majesty the King (Federal Court File No. T-982-20), followed. The Federal Court approved an $8.7-million settlement, and — after the standard appeal window closed with no challenges — the claims portal officially opened on August 4, 2026. The government has not admitted any wrongdoing; this is a negotiated settlement, not a court finding of liability.

What it means for you: This isn't a scam email asking you to "verify your account." It's a real, court-approved settlement — but you have to actively file a claim. Nobody is getting a cheque automatically.

Who actually qualifies

The class is defined broadly — anyone whose personal or financial information in a CRA account, My Service Canada Account, or other GCKey-linked account was disclosed without authorization between March 1 and December 31, 2020. But actual compensation is narrower. You're eligible for a payment only if:

• Your account was accessed without authorization during the credential-stuffing attacks specifically between June 26 and August 18, 2020, or
• Your information was accessed through a Represent a Client (RAC) account between October 8 and November 25, 2020.

Not sure if you fall inside those windows? You can check your eligibility directly on the settlement website at breachsettlementcanada.kpmg.ca — that lookup has been available since January 2026.

How much you could get

Compensation falls into three tiers, and most people will land in the first one:

Claim type	Who it's for	Maximum
Access claim	Account was accessed, but not used fraudulently. Paid at $20/hour for time and inconvenience, up to 4 hours.	$80
Fraud claim	Account was used fraudulently — e.g., a false CERB, CESB, or EI claim was filed, or benefits were diverted. Paid at $20/hour, up to 10 hours.	$200
Special Compensation Fund	Reimbursement for documented out-of-pocket costs: unreimbursed fraud losses, identity-theft-related professional fees, or credit-freeze fees/penalties.	$5,000

One catch worth flagging: payment amounts "may be reduced depending on the number of approved claims," per the official notice. In other words, the $5,000 figure is a ceiling, not a guarantee — the actual payout depends on how many other Class Members file and how the settlement fund gets divided up.

How to apply

1. Go to breachsettlementcanada.kpmg.ca and confirm your eligibility.
2. File your claim online through the same site. You can also apply by email (breachsettlementcanada@kpmg.ca), fax (514-840-2390), or mail to KPMG's Montreal office (attention: Canada Privacy Breach Class Action Administrator).
3. For the Special Compensation Fund (up to $5,000), be ready to document your losses — receipts, credit-freeze fees, or records of professional help you paid for after the breach.
4. Submit before the deadline: February 3, 2027. Claims filed after that date may not be considered.

Watch for copycat scams

Whenever a real settlement like this gets media attention, scammers follow. Consumer protection groups have flagged messages falsely claiming every Canadian is automatically eligible for $5,000. A few rules of thumb:

• The real claims site is breachsettlementcanada.kpmg.ca — double-check the domain before entering any information.
• You will never be asked to pay a fee to "unlock" your settlement money.
• You will never be asked for your full online banking login credentials to file a claim.

Bottom line: This settlement won't make anyone rich, but for the cost of a few minutes online, it's free money you're already entitled to if you were affected. If you had a CRA or Service Canada account back in 2020, it's worth checking — and if you don't qualify, at least use it as a nudge to turn on multi-factor authentication and use a unique password for every government and financial account you hold.

This article is for informational purposes only and does not constitute legal or financial advice. For questions about your specific eligibility or claim, contact the Claims Administrator (KPMG) or Class Counsel directly using the information above.