Canadians who had their personal information compromised in a 2020 data breach involving Canada Revenue Agency (CRA) online accounts can now submit claims for a share of an $8.7 million settlement. The claims period officially opened on August 4, 2026, following the Federal Court's approval of the settlement on May 5, 2026.
The class-action lawsuit stemmed from "credential stuffing" cyberattacks that targeted GCKey services and CRA accounts in August 2020. Hackers allegedly exploited "inadequate safeguards" to access sensitive information, including social insurance numbers, addresses, and banking details. In many instances, this information was used to fraudulently apply for COVID-19 emergency benefits like the Canada Emergency Response Benefit (CERB).
The settlement offers different compensation tiers. Those whose information was accessed but not used for fraud can claim up to $80 for inconvenience and time spent dealing with the breach. Individuals who experienced fraudulent use of their data may be eligible for up to $200. Additionally, a special compensation fund allows for claims up to $5,000 to cover out-of-pocket expenses incurred due to identity theft or fraud.
Eligible class members, defined as those whose personal or financial information was disclosed without authorization between March 1, 2020, and December 31, 2020, have until February 3, 2027, to submit their claims online or by mail. The Treasury Board of Canada Secretariat has stated that the settlement represents a compromise of disputed claims and is not an admission of wrongdoing.
