People whose personal or financial information in a Government of Canada online account — CRA My Account, My Service Canada or another GCKey account — was disclosed without authorization in the 2020 credential-stuffing attacks may qualify to claim up to $80 CAD for account access or up to $200 CAD where fraud followed, plus up to $5,000 CAD in documented costs, from the Canada CRA and GCKey privacy breach class action settlement. The Federal Court approved the settlement on May 5, 2026, and claims close February 3, 2027.
Current Status
Claims are open. The claims period began August 4, 2026 and runs until February 3, 2027; the official notice gives no time of day, so file early. The Federal Court of Canada approved the settlement on May 5, 2026, so there is no further approval hearing. The deadline to opt out passed on February 20, 2026. No payment date had been announced as of September 24, 2026.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Changed Recently?
The claims period opened on August 4, 2026, following the Federal Court of Canada's approval of the settlement on May 5, 2026 (Sweet v. His Majesty the King, 2026 FC 590, Justice Southcott). The action, Federal Court File No. T-982-20, had been certified as a class proceeding in 2022 (2022 FC 1228).The case arose from two sets of incidents in 2020. From June 26 to August 18, 2020, attackers used credential stuffing — trying usernames and passwords stolen elsewhere — against CRA My Account, GCKey and Employment and Social Development Canada accounts. From October 8 to November 25, 2020, the CRA's Represent-a-Client portal was misused. The plaintiffs allege the Government of Canada failed to protect the personal and financial information held in those accounts. The Crown denies wrongdoing, and the settlement is not an admission of liability.
Who Qualifies?
The class is made up of all persons whose personal or financial information in a Government of Canada online account — including CRA My Account, My Service Canada and other accounts accessed with GCKey — was disclosed to a third party without authorization between March 1, 2020 and December 31, 2020.Compensation is narrower than the class. Payments are available only for the two breach periods: June 26 to August 18, 2020 (the credential-stuffing attacks) and October 8 to November 25, 2020 (the Represent-a-Client misuse). People who opted out by February 20, 2026 are not part of the settlement. The class is not limited by where a person lives; it turns on whether their Government of Canada account was affected.
How Much Can You Get?
The Government of Canada is paying an all-inclusive $8,760,500.90 CAD, which covers class member compensation, administration and class counsel fees. Class members claim in up to two categories:- Access claim — up to $80 CAD. For people whose account was accessed without authorization, paid at $20 CAD an hour for up to four hours of time spent dealing with it.
- Fraud claim — up to $200 CAD. For people whose account access led to fraud, paid at $20 CAD an hour for up to ten hours.
- Special Compensation — up to $5,000 CAD. Reimbursement of documented out-of-pocket costs incurred within 12 months of the breach period, available in addition to an Access or Fraud claim.
The most one person can receive is $5,200 CAD. Each category has its own pool: up to $2,720,000 CAD for Access claims, up to $2,800,000 CAD for Fraud claims, and $500,000 CAD plus any unused money for Special Compensation. If approved claims in a pool exceed what it holds, payments in that pool are reduced pro rata. Any money left over goes to the Privacy and Access Council of Canada.
The Court approved class counsel fees of $2,090,182.18 CAD plus $89,255.81 CAD in disbursements, paid from the settlement amount, along with honoraria for the representative plaintiffs.
What Proof or Notice ID Is Required?
No administrator-issued code is needed to get started. The claims portal checks eligibility against the government's breach records using either the PIN from a notice, if you received one, or your last name, email address and the last three digits of your Social Insurance Number.Access and Fraud claims are paid at a set hourly rate. Special Compensation is different: it reimburses documented out-of-pocket costs, so receipts or other records of each expense are needed for that part of a claim.
What Is the Deadline?
Claims must be submitted by February 3, 2027. The notice gives the date only, without a time of day or time zone, so filing well before the last day is the safe course. The opt-out deadline of February 20, 2026 has already passed.How Do You Take Action?
Claims are filed through the official settlement claims portal run by KPMG. Start with the eligibility check, using the PIN from your notice or your last name, email address and the last three digits of your SIN. If you are eligible, complete the claim for the category that fits what happened to your account, add Special Compensation with supporting documents if you had out-of-pocket costs, and choose to be paid by e-transfer or cheque.KPMG is the court-appointed claims administrator, and Rice Parsons Leoni & Elliott LLP is class counsel. OpenClassActions is not affiliated with either and cannot check whether your account was affected.
What Happens Next?
The settlement is already approved, so the next milestone is the close of the claims period on February 3, 2027. Because pro rata reductions depend on the total of approved claims in each pool, final payment amounts cannot be set until claims are reviewed. No payment date had been announced as of September 24, 2026.Sources and Verification
- The official KPMG settlement claims portal, including the notice of settlement approval and the eligibility check.
- Notice of Settlement Approval on Canada.ca, Federal Court File No. T-982-20.
- Reasons for Order approving the settlement, Sweet v. His Majesty the King, 2026 FC 590 (May 5, 2026).
- Certification decision in the same proceeding, 2022 FC 1228.
Questions
My CRA account was breached in 2020 but outside the two attack periods. Can I be paid?
The class covers unauthorized disclosures from March 1 to December 31, 2020, but compensation is paid only for the two breach periods the settlement names: the credential-stuffing attacks of June 26 to August 18, 2020 and the Represent-a-Client misuse of October 8 to November 25, 2020. The eligibility check on the claims portal will tell you whether your account falls within them.
Can I claim both the fraud payment and Special Compensation?
Yes. The combined maximum for one person is $5,200 CAD, which is the $200 CAD fraud payment plus up to $5,000 CAD in Special Compensation for documented out-of-pocket costs. An Access claim and a Fraud claim are alternatives based on what happened to your account; Special Compensation sits on top of either.
Will payments be reduced if many people claim?
They can be. Each claim category has its own pool — up to $2,720,000 CAD for Access claims, up to $2,800,000 CAD for Fraud claims and $500,000 CAD plus any unused money for Special Compensation — and payments within a pool are reduced pro rata if approved claims exceed it.
I opted out of the class action. Can I still claim?
No. The opt-out deadline was February 20, 2026. People who opted out by then are not part of the settlement and cannot claim from it. Everyone else in the class is bound by the settlement whether or not they file.
