An $8.7M CRA settlement was approved and some Canadians can claim over $5k

If your Canada Revenue Agency (CRA) or Service Canada account was compromised, there may be big money coming your way.

A federal court approved an $8.7 million class action settlement on May 5, 2026, resolving a lawsuit against the Government of Canada over a series of cyberattacks that exposed the personal and financial information of thousands of Canadians. The government denies any wrongdoing, and the settlement was reached to avoid a lengthy legal process.

The lawsuit alleged that inadequate safeguards allowed unauthorized third parties to access confidential information across several government platforms, including CRA My Account, My Service Canada Account, and other accounts using GCKey.

The attacks took place between June 15 and August 30, 2020, using a technique called credential stuffing, where hackers use passwords stolen from other websites to break into accounts elsewhere. In many cases, the stolen access was used to file fraudulent CERB applications in victims’ names.

Over 47,000 Canadians were impacted.

Who qualifies?

You’re considered a class member if your personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1 and December 31, 2020. That said, not all class members are automatically entitled to a payment. Only those whose accounts were accessed during the credential stuffing attacks between June 15 and August 30, 2020, and whose information was accessed or used for fraudulent purposes, are eligible for compensation.

If KPMG sent you an email about this settlement, you are eligible to apply.

You can check your eligibility directly through the settlement website at breachsettlementcanada.kpmg.ca by entering your last name, the last three digits of your SIN and your email address.

How much can you claim?

Eligible Canadians can receive compensation across three categories:

• Up to $80 for time spent dealing with unauthorized access to your account
• Up to $200 for time spent addressing fraudulent use of your personal information
• Up to $5,000 for out-of-pocket expenses directly tied to the breach, such as unreimbursed fraud losses or identity theft-related costs

What’s next?

The claims process hasn’t opened yet, so there’s nothing to submit right now. Once the judgment becomes final, the process will open and instructions will be sent out to eligible class members.