You Could Be Eligible for Part of $8.7M Government of Canada Class Action Settlement
A Federal Court-approved settlement has been reached in a Government of Canada privacy breach class action involving online accounts such as CRA My Account, My Service Canada Account and other accounts accessed through GCKey.
Eligible Canadians may soon be able to claim compensation from an $8.76 million settlement, though the claims process has not opened yet.
What the Class Action Is About
The lawsuit alleged that inadequate safeguards allowed unauthorized third parties to access confidential personal and financial information in Government of Canada online accounts.
The affected accounts include Canada Revenue Agency accounts, My Service Canada accounts and other federal online accounts accessed through GCKey. In some cases, the unauthorized access allegedly led to fraudulent benefit applications. The Government of Canada denies wrongdoing.
Settlement Approved by Federal Court
The Federal Court has approved the national settlement in Sweet v. His Majesty the King.
Under the agreement, the government will pay $8,760,500.90 to resolve claims related to unauthorized disclosure of personal or financial information, including notice and administration costs.
Who Is Considered a Class Member?
You may be a class member if your personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020.
This includes affected CRA accounts, My Service Canada accounts and other online government accounts accessed using GCKey.
Not Every Class Member Can Claim Payment
Although many people may fall within the class definition, not everyone will qualify for compensation.
Payments are limited to class members whose information was accessed during the credential stuffing attacks between June 15, 2020, and August 30, 2020, and whose personal information was accessed or used for fraudulent purposes.
What Were the Credential Stuffing Attacks?
Credential stuffing happens when attackers use stolen usernames and passwords from other breaches to try logging into different online accounts.
The Government of Canada said it responded in August 2020 to credential stuffing attacks involving GCKey services and CRA accounts, which later led to the class action.
How to Know If You Are Eligible
If you received an email notice from KPMG, the court-approved claims administrator, you are eligible to apply for payment under the settlement.
People who did not receive an email can check eligibility through the official settlement website by entering their last name, the last three digits of their SIN and their email address.
Expected Compensation Amounts
Eligible class members who submit valid claims may receive different amounts depending on what happened in their case.
Access Claims: Up to $80 for time spent dealing with issues connected to unauthorized access.
Fraud Claims: Up to $200 for time spent addressing fraudulent use of personal information.
Special Compensation Fund Claims: Up to $5,000 for documented out-of-pocket expenses, such as unreimbursed fraud losses, identity theft costs or related professional fees.
Payments Could Be Reduced
The listed compensation amounts are maximum expected amounts.
Final payments may be reduced depending on how many valid claims are submitted and approved through the settlement process.
Claims Process Has Not Started Yet
Eligible Canadians cannot submit claims immediately.
The settlement website says class members do not need to do anything right now and should check the site regularly for updates and instructions on how to apply for compensation.
Opt-Out and Objection Periods Are Closed
The deadline to opt out or object to the settlement was February 20, 2026, at 11:59 p.m. PST.
The settlement approval hearing took place on March 31, 2026, and the settlement was approved on May 5, 2026.
The approved Government of Canada privacy breach settlement could provide compensation to eligible people whose CRA, Service Canada or GCKey-linked accounts were affected by unauthorized access in 2020.
However, only certain class members qualify for payment, especially those connected to the June-to-August credential stuffing attacks.
Since the claims process has not opened yet, affected Canadians should watch the official settlement updates closely and confirm eligibility before expecting compensation.
