Claims Portal Expected to Open This Summer Following Court-Approved $8.76 Million Settlement
CRA Data Breach Settlement Approved : Thousands of Canadians affected by the 2020 CRA My Account and My Service Canada Account cyberattacks could soon be eligible to claim compensation under a court-approved class action settlement worth $8.76 million.
The Federal Court approved the settlement in May 2026 following years of litigation related to the massive credential-stuffing attacks that compromised more than 47,000 Government of Canada online accounts during the COVID-19 pandemic.
Eligible Canadians may receive compensation ranging from $80 to as much as $5,280, depending on how the breach affected them and whether they experienced financial losses or identity-related fraud.
The claims portal is expected to open later this summer after the appeal period expires.
Quick Highlights : CRA Data Breach Settlement
- Federal Court approved an $8.76 million settlement.
- More than 47,000 federal government accounts were compromised.
- Eligible Canadians may claim up to $5,280.
- Claims portal expected to open in Summer 2026.
- CRA My Account and My Service Canada Account users may qualify.
- KPMG will administer the compensation process.
- Eligible claimants will have six months to submit claims.
What Happened in the CRA Data Breach?
Between June and August 2020, cybercriminals launched large-scale credential-stuffing attacks targeting Government of Canada online services.
Credential stuffing occurs when hackers use usernames and passwords obtained from unrelated data breaches and attempt to gain access to accounts on other platforms.
The attacks affected:
CRA My Account
My Service Canada Account
GCKey-linked Federal Accounts
According to court documents, more than 47,000 government accounts were compromised during the attacks.
Hackers allegedly gained access to sensitive personal information including:
- Social Insurance Numbers (SINs)
- Home addresses
- Banking information
- Government benefit records
In some cases, criminals reportedly used compromised accounts to submit fraudulent CERB and CESB benefit applications.
Federal Court Approves CRA Data Breach Settlement
The class action lawsuit, originally launched in 2020, resulted in a settlement agreement between the Government of Canada and affected individuals.
Key Settlement Details
| Item | Details |
|---|---|
| Settlement Value | $8.76 Million |
| Court Approval Date | May 5, 2026 |
| Accounts Affected | 47,000+ |
| Claims Administrator | KPMG |
| Claims Portal Opening | Expected Summer 2026 |
| Claim Filing Window | Six Months |
The settlement was approved by the Federal Court following a hearing held earlier this year.
Who Is Eligible For CRA Data Breach Settlement?
Not every Canadian with a CRA account automatically qualifies.
You may be eligible if:
Your Information Was Accessed Without Authorization
and
The Unauthorized Access Occurred During the 2020 Attacks
Eligible accounts include:
- CRA My Account
- My Service Canada Account
- Other Government of Canada accounts accessed through GCKey
Many eligible individuals have already received notifications from KPMG regarding the settlement.
Canadians can also verify eligibility once the claims process officially opens.
How Much Compensation Can You Receive in CRA Data Breach Settlement?
The settlement creates three separate compensation categories.
Tier 1: Access Claims
Maximum Payment: $80
This category applies to individuals whose account information was accessed by an unauthorized party but was not used for fraud.
Compensation is based on:
- Time spent contacting CRA
- Account recovery efforts
- Security-related actions
Payment is calculated at:
$20 Per Hour
for up to four hours.
Tier 2: Fraud Claims
Maximum Payment: $200
This category applies when personal information was actually used for fraudulent activity.
Examples include:
- Fraudulent CERB claims
- Unauthorized benefit applications
- Identity-related misuse
Claimants can receive compensation for:
- Time spent correcting records
- Contacting government departments
- Resolving fraud-related issues
Compensation remains $20 per hour but covers up to 10 hours.
Tier 3: Special Compensation Fund
Maximum Payment: $5,000
This category is reserved for individuals who suffered documented financial losses.
Eligible expenses may include:
- Credit monitoring services
- Identity theft recovery costs
- Professional service fees
- Unreimbursed financial losses
- Replacement identification documents
Supporting documentation will be required.
Maximum Combined Payment
Canadians who qualify under multiple categories may receive:
Up to $5,280
in total compensation.
However, actual payouts may vary depending on the number of approved claims and the total funds available for distribution.
Important Dates Canadians Should Know About CRA Data Breach Settlement
Timeline
| Date | Event |
|---|---|
| June–August 2020 | Cyberattacks occur |
| August 2020 | Class action filed |
| August 2022 | Federal Court certifies class action |
| December 2025 | Settlement agreement reached |
| May 5, 2026 | Court approval granted |
| Summer 2026 | Claims portal expected to open |
| Six Months After Launch | Claims deadline |
Eligible Canadians are encouraged to monitor official updates once the portal becomes available.
How to Prepare Before the Claims Portal Opens For CRA Data Breach Settlement
Even though claims cannot yet be submitted, affected individuals can begin preparing now.
Step 1
Gather any correspondence related to the breach.
Step 2
Collect records of fraudulent benefit applications or identity theft incidents.
Step 3
Save receipts for:
- Credit monitoring subscriptions
- Identity recovery services
- Legal or professional assistance
Step 4
Review your CRA and Service Canada account security settings.
Step 5
Monitor official settlement updates from KPMG.
Preparing documentation early may help speed up the claims process once submissions begin.
Beware of Settlement Scams
Authorities are warning Canadians about fraudulent messages claiming to offer settlement payments.
To protect yourself:
Never Pay a Fee
Legitimate settlement payments never require upfront fees.
Use Only Official Channels
Claims will be processed exclusively through the authorized settlement administrator.
Ignore Unsolicited Messages
Delete suspicious emails or text messages claiming you have already been approved for compensation.
Cybersecurity experts expect scammers to exploit public interest in the settlement once the claims portal opens.
Why CRA Data Breach Settlement Matters
The CRA breach remains one of the largest cyber incidents involving Government of Canada online services.
The CRA Data Breach Settlement is significant because it:
- Provides compensation to affected Canadians.
- Recognizes the impact of identity-related breaches.
- Encourages stronger cybersecurity protections.
- Highlights the importance of safeguarding personal information online.
The case also serves as a reminder for Canadians to use unique passwords, enable multi-factor authentication where available, and regularly monitor government accounts for suspicious activity.
Key Takeaways Of CRA Data Breach Settlement
- Federal Court approved an $8.76 million CRA breach settlement.
- More than 47,000 government accounts were affected.
- Eligible Canadians could receive up to $5,280.
- Claims portal expected to open during Summer 2026.
- KPMG will administer the compensation process.
- Three compensation tiers are available.
- Claimants should begin gathering documentation now.
- Canadians should remain alert for settlement-related scams.
FAQ : CRA Data Breach Settlement
When will the CRA settlement claims portal open?
The portal is expected to launch during Summer 2026 after the appeal period expires.
How much compensation is available in CRA Data Breach Settlement?
Eligible Canadians may receive up to $5,280 depending on the circumstances of their claim.
Which accounts were affected?
CRA My Account, My Service Canada Account, and certain GCKey-linked federal accounts were impacted.
Do I need documentation in CRA Data Breach Settlement?
Documentation is generally required for fraud claims and reimbursement claims involving financial losses.
Who is administering the CRA Data Breach Settlement?
KPMG has been appointed as the official settlement administrator.
Source : Immigration News Canada
Read About : Canada Enters Technical Recession as GDP Contracts for Second Consecutive Quarter in 2026
