CRA Lawsuit Settlement: Who Can Claim Up to $5,000 and How to Check Eligibility

Thousands of Canadians whose Government of Canada online accounts were compromised during cyberattacks in 2020 can now apply for compensation under an $8.7 million (£4.9 million) class-action settlement. Eligible claimants may receive up to $5,000 (£2,800) for verified identity theft and fraud-related losses, depending on how they were affected.

The claims process opened on 4 August following approval by the Federal Court of the settlement in Sweet v His Majesty the King. The lawsuit centred on allegations that inadequate safeguards allowed unauthorised access to personal and financial information held through Government of Canada online services, including the Canada Revenue Agency's My Account, My Service Canada accounts and other accounts accessed using GCKey.

During the 2020 attacks, cybercriminals used previously compromised usernames and passwords to access government accounts and, in some cases, fraudulently claimed pandemic support payments such as the Canada Emergency Response Benefit (CERB). The Government of Canada denies any wrongdoing, and the settlement does not represent an admission of liability. Eligible claimants can now check whether they qualify through KPMG, the court-appointed claims administrator, before submitting claims by 3 February 2027.

Who Can Claim?

Not everyone affected by the 2020 privacy breaches will qualify for compensation. The settlement class includes anyone whose personal or financial information in a Government of Canada online account was disclosed to an unauthorised third party between 1 March and 31 December 2020.

However, payments are limited to people whose accounts were affected during a series of credential-stuffing attacks carried out between 15 June and 30 August 2020, when cybercriminals used previously compromised usernames and passwords to gain access to government accounts. The settlement also covers eligible victims whose information was accessed through a compromised Represent a Client account, a service used by authorised tax representatives, during a separate breach later that year.

Canadians can check their eligibility through KPMG's settlement website by entering their surname and the final three digits of their Social Insurance Number. Anyone who received a notification by email or post from KPMG is also eligible to submit a claim, although compensation is not automatic and requires a completed application.

What Compensation Is Available?

Eligible claimants can apply under three compensation categories. People whose personal information was accessed, but not used fraudulently, can claim compensation for up to four hours spent dealing with the breach at $20 per hour, with payments capped at $80 (£45).

Those whose information was accessed and used fraudulently, including fraudulent CERB, CESB or Employment Insurance claims, may claim for up to 10 hours at the same hourly rate, with payments capped at $200 (£110).

Both groups may also apply for reimbursement of verified out-of-pocket expenses of up to $5,000 (£2,800). Eligible costs include unreimbursed fraud losses, identity theft recovery expenses, professional fees and costs associated with protecting or restoring financial records.

KPMG said individual payments may be reduced proportionally if approved claims exceed the available settlement fund.

How to Apply

Claims can be submitted online through KPMG's settlement website or by post until 3 February 2027.

The Treasury Board of Canada Secretariat said the settlement represents 'a compromise of disputed claims' and 'is not an admission of wrongdoing' by the federal government. Any settlement funds remaining after approved claims have been paid will be transferred to the Privacy and Access Council of Canada to support independent privacy research.