The CRA data breach settlement is now one of the most talked-about government compensation cases in Canada after the federal government agreed to pay $8.7 million to settle a class-action lawsuit linked to hacked Canada Revenue Agency accounts.
The settlement follows the massive 2020 cyberattack that exposed sensitive personal and financial information belonging to tens of thousands of Canadians. Many victims later discovered hackers had used their stolen identities to apply for COVID-19 emergency benefits such as CERB and CESB.
Now, affected Canadians are searching for answers about the CRA data breach settlement payment dates, eligibility requirements, compensation amounts, and how to submit claims.
What Is the CRA Data Breach Settlement?
The CRA data breach settlement is a court-approved agreement between the Canadian federal government and victims affected by the 2020 cyberattacks targeting CRA MyAccount and other Government of Canada online portals.
Calculate Your 2026 COLA Increase →The class-action lawsuit accused the government and the Canada Revenue Agency of failing to adequately protect users’ personal information during the cyberattacks.
The Federal Court approved the settlement in May 2026 after years of legal proceedings.
Under the settlement agreement:
- The Canadian government will pay $8.7 million
- Eligible victims can receive compensation
- Some claimants may recover up to $5,000 in documented losses
- KPMG will administer the settlement process
CRA Data Breach Settlement Eligibility Requirements
One of the top questions online is:
“Who qualifies for the CRA data breach settlement?”
To qualify for compensation under the CRA data breach settlement, individuals generally must have had their information compromised during the 2020 attacks.
You May Qualify If:
- Your CRA MyAccount was hacked between June 26 and August 18, 2020
- Your Government of Canada online account was compromised
- Hackers accessed your personal information
- Fraudsters applied for CERB or CESB benefits using your identity
- Your legitimate government payments were redirected
- You spent time resolving fraud or identity theft issues
- You incurred financial losses related to the cyberattack
The settlement also covers some victims whose accounts were accessed through:
- My Service Canada Account
- GCKey login services
- Other linked federal online systems
CRA Data Breach Settlement Payment Amounts
The CRA data breach settlement includes different compensation categories depending on the impact experienced by each claimant.
Payment for Lost Time and Inconvenience
Eligible claimants can receive compensation for time spent dealing with the breach.
Compensation includes:
- $20 per hour
- Maximum of four hours
- Up to $80 total
This category covers:
- Password resets
- Phone calls to CRA
- Account recovery efforts
- Monitoring financial accounts
- Administrative inconvenience
CERB Fraud Compensation
Victims whose identities were used to fraudulently apply for CERB or CESB benefits may receive additional compensation.
This category provides:
- $20 per hour
- Up to 10 hours
- Maximum payment of $200
Reimbursement for Financial Losses
Under the CRA data breach settlement, claimants may also seek reimbursement for out-of-pocket costs connected to identity theft or fraud.
Eligible expenses may include:
- Credit monitoring subscriptions
- Banking fees
- Unauthorized charges
- Legal expenses
- Fraud recovery services
- Identity theft protection costs
Maximum reimbursement:
- Up to $5,000 per claimant
Supporting documents will likely be required.
CRA Data Breach Settlement Payment Dates
Search interest around “CRA data breach settlement payment dates” has surged following court approval of the settlement.
Although exact payment dates have not yet been officially announced, the process is expected to follow several stages:
- Claims submission
- Claims review
- Verification process
- Payment distribution
Once claims are approved, eligible Canadians may begin receiving payments.
Claimants should watch for updates regarding:
- Claim deadlines
- Payment schedules
- Processing timelines
- Required documentation
CRA Data Breach Settlement Payment Methods
Many Canadians also want to know how the settlement payments will be sent.
The CRA data breach settlement administrator is expected to offer multiple payment options.
Potential payment methods include:
- Direct deposit
- Electronic bank transfer
- Mailed cheque payments
Claimants may need to provide updated banking details when filing claims.
How to File a CRA Data Breach Settlement Claim
Eligible Canadians will likely need to complete an official claims process managed by KPMG.
The general process may include:
Step 1: Visit the Settlement Website
Affected individuals should access the official settlement portal once claims officially open.
Step 2: Complete the Claim Form
Claimants may need to provide:
- Full name
- Contact details
- Account information
- Description of losses or inconvenience
Step 3: Upload Supporting Documents
If claiming financial losses, supporting evidence may be required, including:
- Receipts
- Credit monitoring invoices
- Fraud reports
- Bank statements
- CRA correspondence
Step 4: Submit Before the Deadline
Late submissions may not qualify for payment.
Why the CRA Data Breach Happened
The CRA data breach was caused largely by a cyberattack method known as credential stuffing.
Credential stuffing occurs when hackers use:
- Previously leaked usernames
- Recycled passwords
- Automated login tools
to access accounts on different websites.
Because many people reuse passwords across multiple platforms, attackers successfully gained entry into thousands of government accounts.
Court documents also revealed that hackers bypassed some CRA security protections because of a software configuration issue.
How Many Canadians Were Affected?
According to reports connected to the CRA data breach settlement:
- More than 47,000 Canadians were affected
- Sensitive personal information was exposed
- Thousands of fraudulent CERB claims were filed
Compromised information included:
- Social Insurance Numbers
- Banking information
- Addresses
- Tax records
- Direct deposit details
Why Some Victims Opposed the CRA Data Breach Settlement
Although the settlement received court approval, some victims objected to the compensation amounts.
Several individuals argued:
- Payments are too small
- Identity theft caused long-term damage
- Emotional distress was not adequately compensated
- Financial harm exceeded settlement limits
However, the Federal Court ruled that the agreement still represented a fair overall settlement for the broader group of affected Canadians.
What Happens to Unclaimed Settlement Money?
Under the settlement terms, leftover funds will not return to the federal government.
Instead, unused money will reportedly be directed toward privacy-related initiatives through the Privacy and Access Council of Canada.
The funding may support:
- Cybersecurity education
- Privacy research
- Consumer protection awareness
- Digital security initiatives
CRA Says Security Measures Have Improved
Following the cyberattacks, the CRA stated it introduced stronger security systems to better protect Canadians.
The agency says current protections now include:
- Improved fraud detection
- Enhanced monitoring systems
- Faster threat response measures
- Additional account security protections
The CRA also continues encouraging Canadians to:
- Use unique passwords
- Enable multi-factor authentication
- Monitor accounts regularly
- Avoid password reuse
Final Thoughts on the CRA Data Breach Settlement
The CRA data breach settlement represents a major development for thousands of Canadians affected by the 2020 government cyberattacks.
While some victims believe the compensation amounts are limited, the settlement provides a path for eligible individuals to recover at least part of their financial losses and inconvenience.
As claim administration moves forward, affected Canadians should closely monitor updates related to:
- CRA data breach settlement payment dates
- Eligibility verification
- Claims deadlines
- Approved payment methods
- Required supporting documents
With online fraud and identity theft continuing to rise globally, the CRA data breach settlement also serves as a warning about the importance of cybersecurity, strong passwords, and protecting personal information online.
