Claims Process Opens for $8.7-Million CRA Data Breach Settlement

In a recent CBC News report, Canadians learned that the claims window has finally opened in the $8.7-million class-action settlement over the 2020 data breach that exposed personal and financial information held in federal online accounts. The Federal Court of Canada approved the settlement in Sweet v. His Majesty the King (2026 FC 590) on May 5, 2026, and the claims process opened on Tuesday. Tens of thousands of Canadians whose social insurance numbers, home addresses and bank details were compromised through CRA My Account, My Service Canada Account and other GCKey-linked portals between March 1 and December 31, 2020 may now be entitled to compensation.

Claims Process Opens for $8.7-Million CRA Data Breach Settlement

Ottawa – This week — The claims administrator KPMG opened the submission window on Tuesday for the Federal Court-approved settlement in Sweet v. His Majesty the King (2026 FC 590). Class members can file online or by mail until February 3, 2027, through the dedicated portal at breachsettlementcanada.kpmg.ca. The $8.7-million fund addresses allegations that inadequate safeguards allowed unauthorized third parties to access confidential personal and financial information in Government of Canada Online Accounts, including CRA My Account, My Service Canada accounts, and other accounts accessed using GCKey.

The Story: Claims Open in $8.7-Million CRA Breach Settlement

The case centres on unauthorized access to federal accounts that occurred between March 1 and December 31, 2020, a period that spanned the first waves of the COVID-19 pandemic. The settlement itself was negotiated last December and received Federal Court approval on May 5, 2026, which gave the agreement binding force across the entire class. In Canada, court approval of a class-action settlement signals that a judge has determined the terms are fair, reasonable and in the best interests of class members, ending the litigation without a trial on liability.

KPMG serves as the court-appointed claims administrator, bringing an independent layer of oversight to the process. The firm is responsible for verifying eligibility, managing the claims portal, issuing payments and reporting to the court on distributions. That structure insulates the administration from both the government and plaintiffs' counsel, ensuring consistent application of the settlement terms across a class that encompasses tens of thousands of Canadians.

Who Is Eligible for Compensation

Eligibility under the settlement hinges on two distinct timeframes. Class membership is defined by the March 1 to December 31, 2020 disclosure window, which captures everyone whose data was potentially compromised in a Government of Canada online account, including CRA My Account, My Service Canada Account and other GCKey-authenticated services. Payment eligibility, however, narrows to those who were victims of unauthorized access during the credential stuffing attacks between June 15 and August 30, 2020.

The tighter window reflects the period when stolen credentials were actively exploited against federal systems, allowing the settlement to focus compensation on demonstrable harm rather than mere exposure. The "accessed and/or used for fraudulent purposes" test requires claimants to show their information was not only at risk but actually misused. Individuals can check their status on the KPMG eligibility page using their last name and the last three digits of their social insurance number, and those who received a PIN by email or letter from KPMG have already been flagged as likely qualifying, streamlining their application.

How Much Money Is Available

The settlement establishes three compensation tiers designed to match different levels of impact. An Access Claim provides up to $80 for time spent addressing issues related to unauthorized access. A Fraud Claim provides up to $200 for time spent addressing fraudulent use of personal information. A Special Compensation Fund offers up to $5,000 for out-of-pocket expenses such as unreimbursed fraud losses and identity theft costs, with claimants required to supply supporting documentation for requests in this tier.

Access Claims and Fraud Claims do not require documentation, while Special Compensation Fund claims do, because larger awards demand greater scrutiny to protect the overall fund. Claimants have a 12-month window following the breach period in which expenses must have been incurred. Because the total pot is fixed, individual awards may be reduced pro rata if the volume of approved claims exceeds expectations. Most ordinary class members should therefore view the lower tiers as modest but certain relief, while reserving the Special Fund for genuinely substantial harm.

Canadian Context: The 2020 Credential Stuffing Attacks

Credential stuffing involves automated attempts to reuse usernames and passwords harvested from unrelated breaches against government portals. During the pandemic, CERB and CESB programs created high-value targets because they offered rapid, direct-deposit payments with relatively light initial verification. The Federal Court decision cites 12,700 cases in which unauthorized third parties changed direct deposit and other information to fraudulently apply for COVID-19 benefits.

The Canada Revenue Agency shut down its online services in August 2020 after identifying approximately 5,500 compromised accounts. Compromised data included social insurance numbers, home addresses and bank account details belonging to tens of thousands of Canadians. At the time, experts said the thieves were after emergency funds meant for pandemic relief, and the agency's own authentication practices came under scrutiny as Canadians questioned how so many accounts could be breached at once. These incidents formed part of a wider surge in pandemic-era fraud that strained federal systems designed for normal volumes, exposing vulnerabilities in authentication infrastructure at a moment when millions of Canadians depended on CERB and CESB payments.

How to Submit a Claim

Claimants should begin at breachsettlementcanada.kpmg.ca and use the eligibility checker before proceeding. Once eligibility is confirmed, selecting "Apply for Compensation" leads to an email-based sign-in where applicants provide their name, phone number, email address, home address and Social Insurance Number. Those who received a PIN from KPMG can enter it to pre-populate verified information. The form also asks for an estimate of hours spent addressing breach-related issues and offers a choice between e-transfer and cheque payment.

Online submissions are processed faster than mailed forms, and e-transfers typically reach claimants more quickly than physical cheques. Mailed claims must arrive at the administrator's office before the February 3, 2027 deadline. Eligible claimants can also download a paper claim form from the KPMG website or email breachsettlementcanada@kpmg.ca for more information. After submission, applicants receive a confirmation email and can expect further communication from KPMG if additional information is required or when payment is issued.

Reactions and Analysis

The Treasury Board of Canada Secretariat issued a statement on Tuesday saying the settlement "has been found to be fair, reasonable, and in the best interests of the class members." The statement emphasises that the agreement "represents a compromise of disputed claims and is not an admission of wrongdoing." KPMG documentation notes that the lawsuit alleges inadequate safeguards permitted unauthorized access, while the Government of Canada denies any wrongdoing in the matter.

Privacy experts and consumer advocates generally view such settlements as imperfect but necessary mechanisms, noting that proving systemic negligence in court would be costly and time-consuming for both sides. The breach also reignited public debate about how much personal information Canadians are required to entrust to government platforms, and whether federal departments invest adequately in the safeguards needed to protect it. The settlement highlights ongoing questions about federal data security practices and the protection of personal information held by departments such as the Canada Revenue Agency, at a time when Canadians continue to rely on GCKey and similar systems for essential services.

What Happens Next

The claims deadline falls on February 3, 2027. After the period closes, KPMG will review submissions, verify documentation for Special Compensation Fund requests and calculate any pro-rata adjustments, with payments expected to follow within several months of the deadline. Any leftover or unclaimed settlement funds will be donated to the Privacy and Access Council of Canada to support privacy research, channeling unclaimed money toward systemic improvements rather than returning it to the government.

The episode underscores ongoing vulnerabilities in federal authentication systems such as GCKey and may prompt renewed scrutiny of how government departments handle credential reuse. Canadians affected by this or similar incidents should treat the settlement as a reminder to monitor financial accounts and consider stronger, unique passwords across services. The case also provides a concrete example of how class actions can address large-scale government data incidents, while underscoring the need for continued investment in cybersecurity defences across federal systems.

By Alex Thompson, Staff Writer

This article was produced with AI-assisted research and editorial support. Reporting is based on sources cited in the article.