Sep 1, 2026
Some Canadians who logged into their Canada Revenue Agency (CRA) account in the summer of 2020 found someone had beaten them to it — with passwords changed, direct deposit details switched and unfamiliar benefit claims filed in their name. “No red flags went off at the CRA,” exclaimed one frustrated user on discussion forum Redflagdeals.com, after discovering fraudulent Canada Emergency Response Benefit (CERB) claims had gone through their hacked account.
Now, six years after this CRA data hack, there’s a price tag attached to the collective frustration and anger experienced by Canadian taxpayers. Eligible Canadians have until Feb. 3, 2027, to apply for a piece of the $8.7-million class-action settlement.
What triggered the class-action lawsuit against the CRA?
During 2020, hackers used stolen or guessed login credentials to break into Government of Canada online accounts, including the CRA My Account and My Service Canada Account portals; it was a process known as a credential stuffing attack.
Thanks for subscribing!
The best of Money.ca delivered weekly.
By signing up, you accept Money.ca Terms of Use, Subscription Agreement, and Privacy Policy.
Once inside, some attackers changed direct deposit information and applied for pandemic benefits — CERB or the Canada Emergency Student Benefit — using victims’ own identities.
Tens of thousands of Canadians had personal information exposed, from social insurance numbers to banking details. As a result, a class action lawsuit, Sweet v. His Majesty the King, was certified in 2022; a settlement was reached last December, and the class action won Federal Court approval in May 2026.
Advertisement
Must Read
- Are you paying too much for car insurance? Here are 3 clever ways to slash your monthly bill
- Here are 5 'must-haves' that Canadians constantly overpay for. How many of these are sabotaging your budget every single month?
- Here are the 5 biggest differences between rich and poor Canadians — which side do you fall on?
Join 19,000+ readers and get Money.ca’s best stories and exclusive interviews first — clear insights curated and delivered weekly. Subscribe now.
Who actually qualifies for the CRA data hack payout?
Not everyone whose account was touched will see a cheque.
Technically, anyone whose personal or financial information in a CRA, My Service Canada or other GCKey-linked account was disclosed without authorization between March 1 and Dec. 31, 2020, qualifies as a member of the class action lawsuit. But payment is limited to accounts breached within a specific period of time. According to court records, the breach period is between June 26 and Aug. 18, 2020. However, claims administrator KPMG lists a different period of time for eligibility — between June 15 and August 30, 2020.
There is another breach period: Anyone whose information was accessed through a Represent a Client account between Oct. 8 and Nov. 25, 2020, also qualifies for a portion of the settlement.
Money.ca reached out to KPMG for a comment; at the time of publication, no response was received.
Any Canadian who was impacted by the CRA data breach can check their eligibility through KPMG’s website. Just enter your last name and first three digits of your social insurance number.
How much money is on the table
Compensation falls into three categories, and claimants can apply to more than one category.
- Category 1: Access claims — up to $80 for time spent dealing with unauthorized access, at $20 an hour for up to four hours
- Category 2: Fraud claims — up to $200 for time spent addressing fraudulent use of personal information, at $20 an hour for up to 10 hours
- Category 3: Special compensation — up to $5,000 to reimburse out-of-pocket costs tied to the breach, including unreimbursed fraud losses, identity-theft fees or credit-freeze charges
Payouts could shrink if approved claims add up to more than the $8.7-million fund can cover. Any money left over will go to the Privacy and Access Council of Canada to fund privacy research.
What to do now
- Check eligibility at breachsettlementcanada.kpmg.ca using your last name and the last three digits of your SIN
- Gather documentation of related costs — credit monitoring fees, fraud-related charges, professional fees — before applying
- File a claim online or by mail no later than Feb. 3, 2027
- Remember the settlement is a compromise, not an admission — the Government of Canada has denied wrongdoing
For Canadians who spent months arguing with banks and the CRA to prove someone else had used their identity, this settlement won’t undo the hassle. But with a five-month runway left before the claim deadline, there’s time to build a documented claim instead of guessing at eligibility.
You May Also Like
- This 7-step plan from Dave Ramsey is designed to help you ditch debt, save more and build wealth — here’s how it works
- Prioritize these 4 critical investments and watch your net worth skyrocket
- Here are 8 solid money moves that could free up real cash every month — here's where to start
- Millionaires under 43 are reshaping investing — just 25% of their portfolios are in stocks. Here’s where their money is going
The most expensive financial mistakes are often the ones you don't see coming. Join 19,000+ Canadians who get the money moves, risks and opportunities shaping their finances — delivered free each week. Subscribe now.
Romana King, Senior Editor at Money.ca, also writes for various North American publications and the RKHomeowner blog. Her book, House Poor No More, is an Amazon bestseller and five-time award winner, including the 2022 New York CPA Society's Excellence in Financial Journalism (EFJ) Book Award.
