A government of Canada class action settled for $8.7 million and here's who could get money

Now that an $8.7 million settlement was approved for the government of Canada class action lawsuit, you might be wondering if you could get money.

Thousands of Canadians are included in this class action because of a privacy breach of their Canada Revenue Agency, Service Canada and other government accounts.

But not every class member is eligible to receive money from the multi-million dollar settlement.

So, here's what you need to know about the lawsuit, the settlement, eligibility, and the claims process.

What is the government of Canada class action lawsuit?

The government of Canada privacy breach class action is related to cyber attacks known as "credential stuffing attacks" that happened between March 1, 2020, and December 31, 2020.

It's alleged that "inadequate safeguards" allowed unauthorized third parties to access confidential personal and/or financial information in government of Canada online accounts.

Online government accounts include CRA My Account, My Service Canada Account, and other accounts that use GCKey.

According to the lawsuit, some fraudulent applications for COVID-19 relief benefits were made with the personal and financial information that was obtained during the cyber attacks.

At least 48,110 online CRA accounts were impacted by the cyber attacks, with 26,250 of those accounts being logged into.

In 13,550 of the My Accounts, only the homepage was viewed, and some personal information was accessed, but no application for benefits was submitted.

In 12,700 of the My Accounts, the taxpayer's direct deposit banking information was changed, and the CERB was fraudulently applied for.

With accounts that use GCKey, 5,957 accounts were potentially impacted by the cyber attack, and 3,200 compromised My Service Canada Accounts were used to access CRA accounts. Then, 1,200 of those accounts were used to apply for CERB or other COVID-related benefits.

What is the settlement?

On May 5, 2026, a federal court approved a settlement for the privacy breach class action.

The $8,760,500.90 settlement will be used to settle claims related to the unauthorized disclosure of personal and/or financial information in online government of Canada accounts.

Even though the class action lawsuit was settled, the federal government denies any wrongdoing.

Who is eligible to make a claim?

You're a class member if your personal or financial information in a government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020.

But not all class members will be able to make a claim for money from this settlement.

Only class members who were victims of unauthorized access by third parties during the credential stuffing cyber attacks between June 15 and August 30, 2020, and whose personal information was accessed and/or used for fraudulent purposes are eligible for compensation.

If you received an email with notice from KPMG, which is the claims administrator for this class action, you're eligible to apply for a payment from the settlement.

You can check your compensation eligibility through the class action site by entering your last name, the last three digits of your SIN and your email address.

How much money could you receive?

There are different types of claims (Access Claim, Fraud Claim and Special Compensation Fund Claim) for this class action lawsuit settlement and various payment levels depending on how you were affected by the privacy breach.

Class members who submit valid claims are expected to get:

• up to $80 for time spent addressing issues related to unauthorized access (Access Claim)
• up to $200 for time spent addressing fraudulent use of personal information (Fraud Claim)
• up to $5,000 for out-of-pocket expenses related to the breach, like unreimbursed fraud losses and identity theft costs (Special Compensation Fund Claim)

Amounts could be reduced depending on the number of claims submitted.

How do you submit a claim?

The claims process hasn't started, which means you can't submit a claim yet if you're eligible to receive compensation.

But instructions on how to apply for compensation from the settlement will be available online through the class action site.

This article's cover image was used for illustrative purposes only.