If you’ve ever gotten that sinking feeling after logging into your CRA account and noticing something wasn’t quite right, this next bit of news might work out in your favour.
A years-old data breach involving the Canada Revenue Agency is finally catching up with the people responsible, and thousands of Canadians could be walking away with money because of it.
Back in 2020, hackers ran a wave of credential-stuffing attacks against several Government of Canada platforms, including CRA My Account and My Service Canada Account, exposing personal and financial information belonging to tens of thousands of people. In some cases, the stolen credentials were used to file fraudulent CERB claims under victims’ names.
That breach led to a class action, Sweet v. His Majesty the King, and on May 5, 2026, the Federal Court signed off on an $8.7-million settlement to compensate those affected. As with most settlements like this, the government hasn’t admitted any wrongdoing.
Here’s what’s changed, and what you need to know if you think you’re owed money
The claims portal is officially open
After the 60-day appeal window closed without a single challenge, the claims process kicked off on August 4, 2026. Eligible Canadians can now file directly through the KPMG-run portal at breachsettlementcanada.kpmg.ca, rather than just checking their eligibility the way they could earlier in the year.
There’s also now a hard deadline: claims need to be submitted by February 3, 2027. If you miss that window, you could lose your shot at compensation entirely.
Who qualifies
You’re technically a class member if your personal or financial information in a Government of Canada online account, whether that’s CRA, My Service Canada, or anything else accessed through GCKey, was exposed to an unauthorized third party sometime between March 1 and December 31, 2020.
But payment is reserved for a narrower group: people whose information was specifically accessed, or accessed and misused, during the credential-stuffing attacks the court has now pinned to a window between June 26 and August 18, 2020. If KPMG has already emailed you directly, you’re in. If not, you can check your own status at breachsettlementcanada.kpmg.ca using your last name, the last three digits of your SIN, and the email tied to your government account.
How much can you receive
Compensation still breaks down into three tiers:
- Up to $80 for time spent dealing with unauthorized account access
- Up to $200 for time spent untangling fraudulent use of your information, like a bogus CERB claim filed in your name
- Up to $5,000 for documented out-of-pocket losses tied directly to the breach, things like credit monitoring fees or unreimbursed financial damage, provided you can back it up with receipts or bank statements
Stack all three, and the theoretical max comes out to $5,280. Just know that your actual payout depends on how many people end up filing valid claims. If approved claims outpace what’s left in the settlement fund, individual payments could shrink. Whatever’s left unclaimed doesn’t go back to Ottawa; it’s earmarked for the Privacy and Access Council of Canada to fund future privacy research.
Watch out for scammers
Fake texts and emails promising a “CRA data breach payout” have been circulating, and they have nothing to do with the actual process. KPMG and the CRA will never ask for a fee to release settlement money, full stop. If you want to check your eligibility or file a claim, the only legitimate way in is breachsettlementcanada.kpmg.ca.
AI tools may have been used to support the creation or distribution of this content; however, it has been carefully edited and fact-checked by a member of MTL Blog’s Editorial team. For more information on our use of AI, please visit our Editorial Standards page.