$8.7 Million CRA Data Breach Settlement Opens — Check If You Can File a Claim

Canadians affected by a major 2020 government data breach can now apply for compensation under an $8.7-million class-action settlement.

The case involves tens of thousands of people whose personal or financial information was compromised when hackers gained unauthorized access to Government of Canada online accounts, including accounts connected to the Canada Revenue Agency (CRA).

According to settlement administrator KPMG, eligible individuals could receive compensation of up to $5,000 in certain cases.

The Treasury Board of Canada Secretariat said the settlement was determined to be fair and reasonable for affected class members. It also emphasized that the agreement represents a compromise of disputed claims and does not amount to an admission of wrongdoing.

What Happened During the 2020 Data Breach?

Hackers targeted federal government accounts over several months in 2020, particularly during the early stages of the COVID-19 pandemic.

In many cases, stolen information was allegedly used to apply for financial assistance in victims’ names, including benefits such as the Canada Emergency Response Benefit (CERB) and Canada Emergency Student Benefit (CESB).

Personal information exposed during the breach included sensitive details such as Social Insurance Numbers, residential addresses and banking information.

The class-action settlement was reached in December and received court approval in May. The claims process officially opened on Tuesday.

Eligible individuals have until February 3, 2027, to submit claims either online or by mail.

Who Is Eligible for the Settlement?

KPMG has clarified that being included in the overall class action does not automatically mean an individual qualifies for compensation.

Class members generally include people whose personal or financial information stored in a Government of Canada online account was disclosed to an unauthorized third party between March 1 and December 31, 2020.

However, payments are limited to individuals affected by unauthorized access between June 15 and August 13, 2020, where their personal information was either accessed or accessed and subsequently used for fraudulent activity.

People who received an eligibility notice from KPMG may also qualify.

Individuals can verify eligibility through KPMG’s settlement website by entering their last name and the final three digits of their Social Insurance Number.

How Much Compensation Could Claimants Receive?

The settlement provides different levels of compensation depending on how the stolen information was affected.

People whose personal information was accessed but not fraudulently used may claim up to $80 for time spent dealing with issues resulting from the unauthorized access.

Those whose information was accessed and then used fraudulently may be entitled to as much as $200 for time spent addressing the fraud.

Eligible members of either group may also claim up to $5,000 in out-of-pocket expenses incurred during the year following the breach. These expenses may include costs associated with identity theft, unauthorized credit card charges and other related fees.

However, the Federal Court of Canada has indicated that individual payments could be reduced depending on the total number of approved claims.

How to Submit a Claim

Eligible Canadians can submit their claim through the KPMG settlement website.

A printable claim form is also available for people who prefer to submit their application by mail. Additional information can be requested by contacting KPMG at breachsettlementcanada@kpmg.ca.

What Happens to Unclaimed Settlement Money?

Any funds remaining after approved claims have been paid will not return directly to individual claimants.

The federal government has agreed that leftover or unclaimed settlement money will be donated to the Privacy and Access Council of Canada to support research related to privacy protection.

Canadians affected by the 2020 government account breach may now be eligible for compensation ranging from payments for time spent resolving the issue to as much as $5,000 for qualifying expenses.

Those who believe they were affected should confirm their eligibility and submit their claim before the February 3, 2027 deadline.