CRA cyberattack settlement opens claims for 47,000 Canadians

A federal court approved an $8.7 million class action settlement May 5 resolving a lawsuit against the Government of Canada over cyberattacks that exposed the personal and financial information of over 47,000 Canadians.

The attacks took place between June 15 and August 30, 2020, using credential stuffing—a technique where hackers use passwords stolen from other websites to break into accounts elsewhere. The breaches affected CRA My Account, My Service Canada Account, and other accounts using GCKey. In many cases, stolen access was used to file fraudulent CERB applications.

The government denies wrongdoing; the settlement was reached to avoid lengthy litigation. However, the settlement acknowledges the breach and establishes eligibility criteria for compensation.

You qualify as a class member if your personal or financial information in a Government of Canada online account was disclosed without authorization between March 1 and December 31, 2020. But not all class members get paid—only those whose accounts were accessed during the credential stuffing attacks (June 15–August 30, 2020) and whose information was accessed or used fraudulently are eligible.

If KPMG sent you an email about the settlement, you're eligible. You can check eligibility at breachsettlementcanada.kpmg.ca using your last name, last three digits of your SIN, and email address.

Eligible Canadians can claim up to $80 for time spent dealing with unauthorized access, up to $200 for time addressing fraudulent use, and up to $5,000 for direct out-of-pocket expenses tied to the breach, such as unreimbursed fraud losses or identity theft costs.

The claims process hasn't opened yet. Once the judgment becomes final, instructions will be sent to eligible class members. If you believe you were affected, register your eligibility now.