Canada Revenue Agency Faces Class Action Fallout as Data Breach Victims Can Now Claim Compensation

Canadians affected by a major 2020 government data breach can now seek compensation after the Federal Court approved a settlement in a class-action lawsuit involving compromised Government of Canada online accounts.

The claims period officially opened on August 4, 2026, giving eligible victims until February 3, 2027, to submit applications. The case centres on unauthorized access to accounts operated through the Canada Revenue Agency (CRA), My Service Canada and other federal services using GCKey.

The lawsuit, known as Sweet v. His Majesty the King, followed a wave of credential-stuffing attacks in 2020. Credential stuffing occurs when criminals use usernames and passwords obtained from previous breaches to attempt access to other online services.

According to the court-approved settlement notice, the alleged attacks resulted in unauthorized access to some Government of Canada accounts and, in certain cases, the use of victims’ information to submit fraudulent applications for government benefits.

Millions at stake in approved settlement

The settlement provides compensation through several categories, although not every person affected by the broader data breach will automatically receive money.

For eligible victims whose information was accessed but not fraudulently used, compensation may cover lost time and inconvenience at a rate of $20 per hour, up to four hours or $80.

Victims whose information was accessed and subsequently used fraudulently may qualify for compensation based on up to 10 hours of time, or a maximum of $200.

The settlement also establishes a special compensation fund for eligible out-of-pocket expenses connected to the breach.

That portion can provide up to $5,000 for qualifying costs, including unreimbursed fraud losses, professional expenses linked to identity theft and certain fees or penalties associated with credit freezes.

However, the court notice warns that payments could be reduced depending on the number of approved claims.

Who may qualify?

The class action covers people whose personal or financial information stored in a Government of Canada online account was disclosed to an unauthorized third party between March 1 and December 31, 2020.

Covered accounts include CRA accounts, My Service Canada accounts and other federal online accounts accessed through GCKey.

But there is an important distinction.

Being part of the class does not necessarily mean a person will receive compensation. The settlement specifically provides payments to eligible individuals whose accounts were subject to unauthorized access during the identified credential-stuffing attacks between June 26 and August 18, 2020.

It also covers certain people whose personal and financial information was accessed through a Represent a Client account between October 8 and November 25, 2020.

The alleged activity occurred during the COVID-19 pandemic, when Canadians were relying heavily on online government services and emergency financial-support programs.

In some cases, unauthorized users allegedly accessed information and submitted fraudulent applications for programs including the Canada Emergency Response Benefit (CERB), the Canada Emergency Student Benefit (CESB) and Employment Insurance.

Government denies wrongdoing

The settlement does not represent an admission of liability by the Canadian government.

The official Federal Court notice states that the lawsuit involved allegations that the government failed to adequately safeguard confidential personal and financial information available through its online portals.

The Government of Canada has denied the allegations and denied that it did anything wrong. The settlement is described as a compromise of disputed claims rather than an admission of wrongdoing or fault.

The Federal Court certified the class action in August 2022 before the parties eventually reached a settlement.

How affected Canadians can claim

The claims process is now open, and eligible individuals can submit their claims through the settlement administrator, KPMG.

The government says potential claimants can also verify their eligibility through the settlement website. People who received an official notice from KPMG by email or mail may be eligible to apply.

The deadline is February 3, 2027.

Anyone who believes they were affected should be cautious about unsolicited messages requesting banking passwords, government login credentials or other sensitive information. Claimants should use official settlement information rather than links supplied through suspicious emails or text messages.

The case highlights the continuing consequences of cyberattacks that occurred years ago. While the original breach took place in 2020, the legal process has taken years to reach the compensation stage.

For affected Canadians, however, the clock is now running.

The claims window is open, and eligible victims have until February 3, 2027, to seek compensation under the court-approved settlement.

SUGGESTED READS

• The Green Children of Woolpit: The Medieval Mystery That Still Defies Explanation
• The Dancing Plague of 1518: The Terrifying Mystery of the People Who Couldn’t Stop Dancing
• The Chilling Mystery of Dyatlov Pass
• The Man Who Received Calls From the Dead
• The Radio Station That Predicted a Murder
• The Bear Who Went to War: The Unbelievable Story of Wojtek
• The Woman Who Fell 33,000 Feet and Lived: The Astonishing Story of Vesna Vulović
• The Great Emu War: When Australia Lost a Battle Against Birds