A years-old data breach involving the Canada Revenue Agency is finally catching up with the people responsible, and thousands of Canadians could be owed money as a result.
Back in 2020, a wave of credential-stuffing attacks hit several Government of Canada platforms, including CRA My Account and My Service Canada Account, exposing personal and financial information belonging to tens of thousands of Canadians. In some cases, the stolen login details were used to file fraudulent CERB applications in victims’ names.
A class action followed, and on May 5, 2026, the Federal Court approved a settlement worth $8,760,500.90 to compensate the people affected. The government hasn’t admitted any wrongdoing as part of the deal.
Here’s everything possible recipients should know.
Who qualifies
You’re a class member if your personal or financial information in a Government of Canada Online Account, including a CRA account, a My Service Canada account, or any other account accessed through GCKey, was disclosed to a third party without authorization sometime between March 1 and December 31, 2020.
Actual payment, though, is limited to a narrower group: people whose information was accessed, or accessed and used fraudulently, specifically during the credential-stuffing attacks between June 15 and August 30, 2020. If KPMG already emailed you directly about the settlement, you’re covered. You can also check your own eligibility directly at breachsettlementcanada.kpmg.ca using your last name, the last three digits of your SIN, and the email address tied to your government account.
What compensation looks like
Payouts are broken into three categories:
- Up to $80 for time spent dealing with unauthorized account access
- Up to $200 for time spent addressing fraudulent use of your personal information, like an unauthorized CERB claim
- Up to $5,000 for out-of-pocket costs directly tied to the breach, such as credit monitoring fees or unreimbursed financial losses, though this category requires documentation like receipts or bank statements
Add those together, and the maximum a single claimant could receive comes out to $5,280.
Actual payouts also depend on how many people file valid claims, so your final amount could end up lower than the maximum if approved claims outpace what’s left in the fund. Whatever goes unclaimed is set to go to the Privacy and Access Council of Canada for future privacy research rather than back to the government. Only 29 people objected to the settlement out of the entire class, and most objections came down to the same complaint: that the compensation felt too low to begin with.
When can you file?
The claims portal hasn’t opened as of yet. Based on the settlement’s terms, it’s expected to go live 60 days after the appeal deadline on the approval judgment passed without challenge. Once it opens, eligible Canadians will have a six-month window to file, either through breachsettlementcanada.kpmg.ca or by phone at 1-833-724-6160.
One more thing worth knowing
Because this settlement has gotten attention, scam texts and emails claiming you’re eligible for a “CRA data breach payout” have started circulating, and they have nothing to do with the real process. KPMG and the CRA will never ask you to pay a fee to release settlement funds. The only legitimate way to check eligibility or file a claim is directly through breachsettlementcanada.kpmg.ca.
AI tools may have been used to support the creation or distribution of this content; however, it has been carefully edited and fact-checked by a member of MTL Blog’s Editorial team. For more information on our use of AI, please visit our Editorial Standards page.
