If you had a My CRA or My Service Canada account back in 2020, this one’s worth five minutes of your time.
A massive government data breach settlement opened its claims portal earlier this month, and if you’re one of the Canadians affected, there’s big money on the table (up to $5,280 per person), depending on what happened to your account.
What happened?
Between June and August 2020, hackers ran a wave of credential-stuffing attacks against the Canada Revenue Agency’s federal login systems, including CRA My Account, My Service Canada Account, and anything tied to GCKey. Some victims had their information accessed. Others had it used outright, with fraudsters filing bogus CERB and CESB claims under their names.
The resulting class action, Sweet v. His Majesty the King, was settled for $8.76 million, a deal the Federal Court approved back in May. No wrongdoing was admitted by the government as part of it.
Who qualifies?
There are two tiers here, and understanding the difference matters before anyone gets their hopes up too high.
Anyone whose personal information was disclosed to a third party without authorization sometime between March 1 and December 31, 2020, counts as a class member. But compensation is reserved for a narrower group: people whose accounts were specifically accessed, or accessed and used fraudulently, during the credential-stuffing window between June 15 and August 30, 2020.
Anyone already contacted directly by KPMG, the company handling claims, with a personal ID number is confirmed. Everyone else can check their own eligibility on KPMG’s settlement site using their last name, the last three digits of their SIN, and the email tied to their government account.
How much is on the table?
The payout breaks down into three categories:
- Up to $80 for time spent dealing with unauthorized account access
- Up to $200 for time spent untangling fraudulent use of personal information
- Up to $5,000 from a special compensation fund, covering out-of-pocket losses like fraud-related costs or identity theft expenses, the only category that requires receipts or documentation
Add it all up, and the theoretical maximum comes to $5,280. That’s not a guarantee by any means, though. Payouts could shrink if the number of approved claims outpaces the funds set aside, and whatever’s left unclaimed won’t be returned to the government. It’s been earmarked for the Privacy and Access Council of Canada instead, to support future privacy research.
How to file
The portal has been open since August 4, so there’s little reason to wait. On KPMG’s website, “Apply for Compensation” is the button to click, followed by registering an account with an email address. Names, phone numbers, addresses and SINs are all required, along with a personal ID number for anyone who was issued one.
Documenting roughly how many hours were spent cleaning up the mess is also part of the process, whether that’s time spent on the phone with the CRA, law enforcement, or credit agencies.
Payment can be issued by e-transfer, which moves faster, or by cheque. Online submissions are processed quicker than mailed ones too, though a paper form is still available for anyone who’d rather go that route.
The window won’t stay open for long, though; the deadline to file sits at February 3, 2027.
AI tools may have been used to support the creation or distribution of this content; however, it has been carefully edited and fact-checked by a member of MTL Blog’s Editorial team. For more information on our use of AI, please visit our Editorial Standards page.