CRA & GCKey Privacy Breach Settlement (Canada)

Only KPMG-listed victims qualify. Being a class member in this case does not mean you get paid, and that single fact disqualifies most people who will read this page. The class covers anyone whose personal or financial information in a Government of Canada online account — a Canada Revenue Agency My Account, a My Service Canada Account, or any federal account reached with a GCKey — was disclosed to a third party without authorization between March 1 and December 31, 2020. Compensation is far narrower than that. The settlement pays only people whose account was hit in the credential-stuffing attacks of June 26 to August 18, 2020, or through a Canada Revenue Agency Represent-a-Client account between October 8 and November 25, 2020. The Government of Canada already identified those accounts and gave the administrator the list — roughly 34,304 Access Claimants and 13,661 Fraud Claimants — and the court-approved claim form says plainly that a claimant whose name does not appear on it will have the claim rejected. Todd Sweet, the representative plaintiff who brought this case, is himself a class member who does not qualify for a payment, because the Federal Court found the breach of his own CRA account was not part of the credential-stuffing attack. So run the eligibility check before you spend any time on a form. Every figure in this settlement is in Canadian dollars. The headline amounts are also not flat payments: an Access or Fraud claim pays $20 CAD an hour for hours you certify, capped at 4 hours ($80 CAD) or 10 hours ($200 CAD), so an hour of your time is worth $20 and not $80. The $5,000 CAD ceiling applies only to the documented out-of-pocket part of the settlement, not to the settlement as a whole, and it stacks on top of an Access or Fraud claim instead of replacing it. That is the reverse of the usual data breach settlement on this site, where a flat payment and a documented tier are alternatives and taking one forfeits the other. Here you claim both. What you cannot do is claim the $5,000 on its own — the portal refuses a submission that does not include at least one Access or Fraud claim.

Do I Qualify?

You may be eligible if:

• YOU MUST BE ON THE ADMINISTRATOR'S ELIGIBLE CLAIMANTS LIST. This is the gate that stops most people, and you cannot argue your way through it. The Government of Canada identified the affected accounts and gave KPMG the list of eligible claimants. The court-approved claim form states it without hedging: your name must appear on that list in order to qualify for compensation, and claimants whose name does not appear will have their claim rejected. Check first on the Eligibility page at www.breachsettlementcanada.kpmg.ca using your last name, your email address and the last 3 digits of your Social Insurance Number, or the 6-character PIN from a notice KPMG emailed or mailed you.
• YOUR ACCOUNT MUST HAVE BEEN HIT INSIDE A PAID WINDOW, AND THOSE WINDOWS ARE MUCH NARROWER THAN THE CLASS PERIOD. The settlement pays for unauthorized access during the credential-stuffing attacks between June 26 and August 18, 2020, and for unauthorized access through a Canada Revenue Agency Represent-a-Client account between October 8 and November 25, 2020. Nothing else is paid.
• THE CLASS PERIOD AND THE PAID PERIOD ARE NOT THE SAME THING, and this is the trap in the case. The class period runs March 1 to December 31, 2020. If your Government of Canada account was compromised in 2020 by some other route, you are a class member, you are bound by the release, and you receive nothing. The Federal Court's reasons say so directly, and point to the representative plaintiff as the example.
• THE ACCOUNT HAS TO BE A GOVERNMENT OF CANADA ONLINE ACCOUNT: a Canada Revenue Agency My Account or Represent-a-Client account, an Employment and Social Development Canada My Service Canada Account, or another federal online account reached using the Government of Canada Branded Credential Service known as GCKey. The claims portal also lists Health Canada and Transport Canada GCKey accounts as claim types.
• WHERE YOU LIVE IS NOT THE TEST, BUT THIS IS STILL NOT A US SETTLEMENT. The class definition turns on the account, not on residence, and the claim form has a Country field — so someone living outside Canada who held a breached CRA or GCKey account can be on the eligible list. What does not qualify is an ordinary American data breach. If you have never held a Government of Canada online account, nothing on this page applies to you, and no US state is covered.
• YOU NEED AN APPROVED ACCESS OR FRAUD CLAIM BEFORE YOU CAN REACH THE $5,000 CAD. Special Compensation is not a standalone benefit. The Federal Court's reasons describe it as available to Access Claimants and Fraud Claimants with approved claims, and the portal returns an error telling you to select at least one Access or Fraud claim if you try to submit without one.
• EXCLUDED PERSONS ARE STILL INCLUDED. Anyone who contacted Murphy Battista LLP about this CRA privacy breach class action before June 24, 2021 is defined as an Excluded Person, but both the court-authorized notice and the administrator confirm that Excluded Persons are included in the settlement. That carve-out does not cost you anything.
• IF YOU OPTED OUT BY FEBRUARY 20, 2026, YOU CANNOT CLAIM. That deadline fell at 11:59 p.m. PST and also closed the objection window. Everyone who did not opt out is bound by the settlement whether or not they file a claim, so not filing forfeits the money without preserving any right to sue.
• ONE POINT TO RAISE WITH KPMG IF YOU ARE FILING FOR SOMEONE WHO HAS DIED. The Federal Court's reasons limit eligible claimants to those still living, yet the claims portal does provide a path for a legal representative to file on behalf of a class member who is deceased, incompetent or under a power of attorney. Those two statements sit awkwardly together. Ask the administrator before relying on either.

There are two very different proof standards in this settlement, and the scanner summary that calls it a no-documentation case is only half right. FIRST, ELIGIBILITY IS VERIFIED AGAINST GOVERNMENT RECORDS, NOT AGAINST ANYTHING YOU SUBMIT. You do not need an administrator-issued code to begin. The Eligibility Check page at www.breachsettlementcanada.kpmg.ca asks only for your last name, your email address and the last 3 digits of your Social Insurance Number; if KPMG emailed or mailed you a notice you can use the 6-character PIN instead. The check is against the list of eligible claimants the Government of Canada supplied, and the court-approved claim form warns that a claim from someone not on that list is rejected. SECOND, AN ACCESS OR FRAUD CLAIM NEEDS NO RECEIPTS — ONLY A CERTIFICATION. You state how many hours you spent communicating with government officials, law enforcement officials or credit agencies about the breach, up to 4 hours for an Access claim or 10 hours for a Fraud claim, and you sign for it. There are no receipts, invoices or police reports to attach for this part, but it is a signed attestation and the form is sworn under penalty of perjury. THIRD, THE $5,000 SPECIAL COMPENSATION DOES REQUIRE DOCUMENTS, AND THE TEST HAS TWO PRONGS. The claim form requires supporting documentation showing (a) the amount of the out-of-pocket expense, that it was incurred inside the applicable period, and that it was not already reimbursed by the Government of Canada or a third party such as a bank; and (b) that your personal information was used or modified, without your knowledge or consent, to impersonate you in connection with a fraudulent act. That second prong is the hard one for an access-only claimant — if nobody actually impersonated you, the documented-expense benefit is difficult to establish even though the form allows an Access Claimant to apply. Receipts, invoices and bank statements are the listed evidence. THE EXPENSE WINDOW IS TIGHT AND ALREADY LONG CLOSED. Costs must have been incurred within 12 months following the breach period — the claim form puts that at on or before August 18, 2021, or November 25, 2021 for Represent-a-Client accounts. A cost you incurred after that date cannot be reimbursed. ONE PRIVACY POINT WORTH KNOWING BEFORE YOU START. The eligibility check asks only for the last 3 digits of your SIN, but Section 6 of the paper claim form lists the full Social Insurance Number as a mandatory field, and KPMG states it may use automation to support decision-making on claims. Filing online through the official portal is the route the administrator says is processed faster.

What Happened?

In the summer of 2020, attackers ran a credential-stuffing attack against Government of Canada online portals, reusing usernames and passwords stolen from other services. A misconfiguration in the Canada Revenue Agency's credential management software let the attackers bypass the security questions that normally protect a CRA My Account. The Federal Court's certification findings record that at least 48,110 My Accounts were affected by unauthorized use of credentials; the attacker actually logged in to 26,250 of them; in 13,550 only the homepage was viewed; and in 12,700 the taxpayer's direct deposit banking information was changed and a fraudulent Canada Emergency Response Benefit application was submitted. CRA remedied the misconfiguration on or about August 10, 2020.

A second incident followed. Between October 8 and November 25, 2020 the Canada Revenue Agency's Represent-a-Client portal was misused: a representative whose own account had been compromised in the credential-stuffing attack was replaced with an unknown representative, who could then reach the personal information of that representative's clients.

The case is Sweet v. His Majesty the King, Federal Court File No. T-982-20, in the Federal Court of Canada. The plaintiff, Todd Sweet, alleges the Government of Canada failed to properly safeguard personal and financial information held in online government portals, allowing bad actors to view confidential information including Social Insurance Numbers, banking details and tax records, and in some cases to apply for CERB, CESB and Employment Insurance benefits in class members' names. The Court certified the action as a class proceeding in 2022 (Sweet v Canada, 2022 FC 1228). The Government of Canada denies the allegations and denies doing anything wrong, and the settlement is not an admission of liability, wrongdoing or fault.

Justice Southcott approved the settlement on May 5, 2026 (2026 FC 590), finding it fair, reasonable and in the best interests of the class, and also approved the legal fees and the honoraria. The order additionally gave the individuals who had objected a further opportunity to opt out. There is no further approval hearing.

The Government of Canada is paying an all-inclusive $8,760,500.90 CAD. That one figure has to cover class member compensation, class counsel fees, disbursements, honoraria, taxes and all claims administration costs, so it is not a pot reserved for claimants. The Court approved class counsel fees of $2,090,182.18 CAD inclusive of taxes plus $89,255.81 CAD in disbursements, and honoraria of $5,000 CAD for Todd Sweet and $1,500 CAD each for Anne Campeau and Tanis Seminoff. The settlement is claims-based: nothing is paid automatically.

Each benefit draws on its own pool. Under the settlement agreement the maximum available is $2,720,000 CAD for Access claims and $2,800,000 CAD for Fraud claims, with a further $500,000 CAD for Special Compensation. Those figures have already come down. Because mailing paper notices cost more than expected — about $973,800.71 CAD including HST as estimated in March 2026 — class counsel told the Court the working limits were roughly $2,529,899.20 CAD, $2,604,308 CAD and $465,055 CAD. If approved claims in a pool exceed that pool, every payment in it is cut pro rata. If a pool is undersubscribed, the leftover is added to the Special Compensation pool, which counsel told the Court is the likely outcome.

Money left after all claims are paid does not revert to the Government of Canada. It goes cy-pres to a qualified donee approved by the Court, and the parties have named the Privacy and Access Council of Canada.

Key dates on the record: the notice period began December 22, 2025; the opt-out and objection deadline was 11:59 p.m. PST on February 20, 2026; the approval hearing was March 31, 2026; the settlement was approved May 5, 2026; the claims period opened August 4, 2026; and claims close February 3, 2027. No payment date has been announced, and final amounts cannot be set until every claim has been reviewed.

How to File Your Claim

1. RUN THE ELIGIBILITY CHECK BEFORE ANYTHING ELSE. Go to https://www.breachsettlementcanada.kpmg.ca and open the Eligibility page. Enter your last name, your email address and the last 3 digits of your Social Insurance Number. If KPMG sent you a notice by email or letter you can use the 6-character PIN from it instead. If your name is not on the list of eligible claimants, a claim will be rejected, so this step saves you the rest
2. OPEN THE APPLY FOR COMPENSATION SECTION on the same site and say whether you are claiming for yourself, as a legal representative for another person, or on behalf of a corporation or related entity
3. SELECT EVERY CLAIM TYPE THAT MATCHES WHAT HAPPENED TO YOU, ACCOUNT BY ACCOUNT. The form has separate sections for a CRA My Account, a CRA Represent-a-Client account, a My Service Canada Account and other Government of Canada accounts reached with a GCKey, and it allows an Access claim, a Fraud claim, or both, depending on your circumstances. The portal will stop you if you select none
4. CERTIFY YOUR HOURS HONESTLY. Each Access or Fraud section asks how many hours you spent communicating with government officials, law enforcement officials or credit agencies about the breach — a maximum of 4 hours on an Access claim and 10 hours on a Fraud claim, paid at $20 CAD an hour — and you sign for the figure you enter
5. ADD THE SPECIAL COMPENSATION CLAIM ONLY IF YOU HAVE DOCUMENTS, and remember it stacks on top of the hourly payment rather than replacing it. You may submit one Special Compensation claim for up to $5,000 CAD of out-of-pocket expenses incurred on or before August 18, 2021 (November 25, 2021 for Represent-a-Client accounts). Attach receipts, invoices or bank statements, and evidence that your information was used to impersonate you in a fraudulent act
6. PICK YOUR PAYMENT METHOD. E-transfer is the fastest. A cheque is mandatory if you are filing as someone else's representative
7. SIGN THE ATTESTATION. The form is signed under penalty of perjury that everything you entered is true, correct and complete
8. FILE BY FEBRUARY 3, 2027. The court-authorized notice gives the date with no time of day and no time zone, so do not leave it to the last day. Claims submitted after the deadline may not be eligible
9. IF YOU CANNOT FILE ONLINE, use the paper claim form and mail it with copies of any supporting documents to KPMG, 600 de Maisonneuve Blvd. West, Suite 1500, Tour KPMG, Montreal, Quebec H3A 0A3, Attention: Canada Privacy Breach Class Action Administrator. The administrator says online claims are processed faster
10. QUESTIONS GO TO THE ADMINISTRATOR, NOT TO THE COURT. Email breachsettlementcanada@kpmg.ca, call toll-free 1-833-724-6160 or fax 514-840-2390. Class counsel is Rice Parsons Leoni & Elliott LLP at classactions@rplelaw.com
11. Visit the official claim form: https://www.breachsettlementcanada.kpmg.ca/

How Much Will I Actually Get?

EVERY AMOUNT ON THIS PAGE IS IN CANADIAN DOLLARS. Nothing here is a US dollar figure. THE BENEFITS STACK — THEY ARE NOT ALTERNATIVES, AND THAT IS UNUSUAL. On most data breach settlements this site covers, a flat no-receipt payment and a documented tier are rival options and taking the flat money forfeits the rest. This settlement works the other way: the Special Compensation Fund is available in addition to an Access or Fraud claim. The Federal Court's reasons say Access Claimants and Fraud Claimants with approved claims may also submit a Special Compensation claim, and the claim form repeats it. Claim everything that fits your circumstances on the one form. ACCESS CLAIM — UP TO $80 CAD. For a class member whose information was accessed but not used fraudulently. It pays $20 CAD an hour for time spent dealing with the breach, capped at 4 hours. FRAUD CLAIM — UP TO $200 CAD. For a class member whose account was taken over and whose information, including direct deposit details, was modified so that CERB, CESB or Employment Insurance benefits could be applied for in their name or diverted to another bank account. It pays the same $20 CAD an hour, capped at 10 hours. SPECIAL COMPENSATION — UP TO $5,000 CAD. Reimbursement of documented out-of-pocket expenses tied to the breach: unreimbursed fraud losses or charges, professional and other fees relating to identity theft, and fees or penalties from credit freezes. THE $5,000 CAP COVERS ONLY THE DOCUMENTED-EXPENSE PART OF THE CASE, NOT THE WHOLE SETTLEMENT. It is the ceiling on that one reimbursement benefit per class member, and it sits on top of the $80 or $200 time payment rather than absorbing it. THE HEADLINE NUMBERS ARE CEILINGS ON AN HOURLY RATE, NOT PAYMENTS. The claim form makes you certify how many hours you actually spent communicating with government officials, law enforcement or credit agencies about the breach, and sign for it. Certify one hour and you are paid $20 CAD, not $80 CAD. ON THE WIDELY QUOTED $5,200 CAD MAXIMUM, BE CAREFUL. That figure is simply $200 plus $5,000. The court-authorized notice, the Federal Court's reasons and the claim form do not state a combined per-person maximum, and the claim form in fact lets a class member file an Access claim, a Fraud claim, or both, across more than one account — there are separate sections for CRA My Account, Represent-a-Client, My Service Canada and other GCKey accounts. Treat $5,200 CAD as the usual single-account ceiling rather than a published cap. PAYMENTS CAN BE CUT PRO RATA, AND THE POOLS HAVE ALREADY SHRUNK. The settlement agreement sets maximums of $2,720,000 CAD for Access claims, $2,800,000 CAD for Fraud claims and $500,000 CAD for Special Compensation, but higher-than-expected notice costs had already reduced the working estimates to about $2,529,899.20 CAD, $2,604,308 CAD and $465,055 CAD when the Court approved the settlement. If approved claims in a pool exceed the pool, every payment in it drops pro rata. Class counsel told the Court that a pro rata cut on Access claims would need a take-up rate near 92 percent and is unlikely, and that leftover money from the Access and Fraud pools will instead be added to the Special Compensation pool. THE $8,760,500.90 CAD HEADLINE IS ALL-INCLUSIVE. Class counsel fees of $2,090,182.18 CAD, $89,255.81 CAD of disbursements, honoraria, taxes and every dollar of administration cost come out of it before claimants are paid. NOTHING GOES BACK TO THE GOVERNMENT. Any residue is paid cy-pres to a Court-approved qualified donee, and the parties have named the Privacy and Access Council of Canada. NO PAYMENT DATE HAS BEEN ANNOUNCED. Amounts cannot be finalised until the claims period closes and all claims are reviewed.

Last reviewed: October 6, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions