An $8.7 million class action settlement has been approved by the Federal Court of Canada, providing compensation to tens of thousands of Canadians whose personal and financial information was compromised in the 2020 GCKey credential-stuffing attacks.
Federal Court Approves $8.7 Million Settlement for CRA Data Breach Victims
On May 5, 2026, Federal Court Justice Richard Southcott approved the settlement in Sweet v. His Majesty the King (2026 FC 590), ruling that the settlement terms are “fair, reasonable, and in the best interests of the class as a whole.”
The Government of Canada has denied any wrongdoing but agreed to the settlement to resolve the litigation without further legal proceedings.
What Happened in 2020? Background on the Breach
In August 2020, hackers launched “credential stuffing” attacks against Government of Canada online accounts. This technique uses stolen usernames and passwords from other data breaches to gain unauthorized access to government accounts.
Calculate Your 2026 COLA Increase →The attack impacted approximately 47,000 Canadians whose accounts were breached between June 15 and August 30, 2020, including:
- Canada Revenue Agency (CRA) My Account
- My Service Canada Account
- Other accounts accessed through GCKey
The Impact:
- Hackers used compromised accounts to apply for emergency COVID-19 benefits
- Fraudulent CERB (Canadian Emergency Response Benefit) applications were filed in victims’ names
- Some attackers diverted legitimate benefit payments to unauthorized bank accounts
- Victims experienced identity theft and had their direct deposit information changed
Who Qualifies for the CRA Settlement?
Not everyone with a CRA account qualifies. The settlement is limited to specific groups of people affected by the specific attacks.
You are eligible if:
- Your Government of Canada online account was accessed without authorization between June 15 and August 30, 2020
- OR your personal or financial information was disclosed to a third party without authorization between March 1 and December 31, 2020
- You received a notification from KPMG (the settlement administrator) about your eligibility
How Much Can You Claim? Compensation Breakdown
The settlement provides three categories of compensation, depending on what impact the breach had on you.
Category 1: Access Compensation — Up to $80
- Compensation for time spent and inconvenience: $20 per hour
- Maximum: 4 hours
- Maximum payout: $80
Category 2: Fraud Compensation — Up to $200
- Compensation for time spent addressing fraud: $20 per hour
- Maximum: 10 hours
- Maximum payout: $200
Category 3: Special Compensation Fund — Up to $5,000
- Up to $5,000 per claim for verified losses
- Includes unreimbursed fraud losses, identity theft costs, and credit monitoring fees
Step-by-Step: How to Claim Your Compensation
Step 1: Verify Your Eligibility (Now – July 2026)
Visit breachsettlementcanada.kpmg.ca and enter your information to confirm you’re part of the settlement class.
Step 2: Gather Your Documentation
- For Access Claims: Proof of time spent
- For Fraud Claims: Documentation of fraudulent applications or transactions
- For Special Compensation: Documented proof of losses (credit card statements, identity theft reports, receipts)
Step 3: Submit Your Claim
When the portal opens, log in and upload supporting documentation. Wait for official KPMG instructions on exact deadlines.
Step 4: Receive Your Payment
Payments are expected via direct deposit or cheque by mail, within 8-12 weeks from submission.
Tax Treatment: Will Your Settlement Payment Be Taxable?
Good news: Settlement payments from this type of breach compensation are generally NOT taxable under the Canadian “surrogatum principle” in tax law.
Your Settlement Payments Are Likely Non-Taxable:
- Access compensation ($80) = replacing time and inconvenience → NON-TAXABLE
- Fraud compensation ($200) = replacing time and emotional distress → NON-TAXABLE
- Special Compensation ($5,000) = reimbursement for out-of-pocket losses → NON-TAXABLE
Keep all documentation for 6-7 years in case the CRA has questions.
Frequently Asked Questions
Q: I received an email claiming I’m eligible for a CRA settlement. Is this real?
A: Be cautious. The only legitimate sources are official KPMG notifications and breachsettlementcanada.kpmg.ca.
Q: What’s the deadline to file a claim?
A: Exact deadlines have not been announced yet. KPMG will notify all eligible class members when claims open (expected 12-18 months after May 5, 2026).
Q: Will I automatically get paid?
A: No. You must actively submit a claim with supporting documentation.
Q: What if I don’t have documentation?
A: For general access claims ($80), you can estimate time spent. For fraud claims ($200), you’ll need some documentation. For Special Compensation ($5,000), you must have documented proof.
Q: Can I get more than $5,000?
A: The maximum is $5,000 per person. However, if total claims exceed available funds, all claims may be reduced pro-rata.
