The government of Canada class action lawsuit is accepting claims for the $8.7M settlement

You can now submit a claim for compensation in the government of Canada class action lawsuit.

Some Canadians are eligible to receive up to $5,000 from the $8.7 million settlement.

This class action is related to a privacy breach of online Canada Revenue Agency and Service Canada accounts, along with other government accounts.

It's alleged that "inadequate safeguards" allowed unauthorized third parties to access confidential personal and/or financial information in online government accounts during cyberattacks between March 1, 2020, and December 31, 2020.

Online government accounts in this class action lawsuit are CRA My Account, My Service Canada Account, and other accounts that use GCKey.

The $8.7 million government of Canada privacy breach class action settlement was approved on May 5, 2026.

You're a class member if your personal or financial information in a government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020.

To be eligible for compensation, you must be a class member and a victim of unauthorized access by third parties during the credential stuffing cyberattacks between June 15 and August 30, 2020, whose personal information was accessed and/or used for fraudulent purposes.

Eligible class members who submit valid claims are expected to receive:

• up to $80 for time spent addressing issues related to unauthorized access (Access Claim)
• up to $200 for time spent addressing fraudulent use of personal information (Fraud Claim)
• up to $5,000 for out-of-pocket expenses related to the breach, like unreimbursed fraud losses and identity theft costs (Special Compensation Fund Claim)

Those amounts could be reduced depending on the number of approved claims.

If you received an email or letter from KPMG with a PIN, you're eligible to apply for a payment from this settlement. If you didn't get anything, you can check your eligibility online using your last name, the last three digits of your SIN and your email address.

The claims period started in August, so eligible class members can submit compensation claims online or by mail now.

Claims submitted through the online claims portal will be processed faster than claims sent through the mail.

If you're unable to submit a claim online, you can complete a paper form and mail it to the claims administrator. The paper claim form is available in the "Documents" section of the class action site.

For online claims, you have to click the "Apply for Compensation" button on the class action site and sign in or sign up with your email to access the claims portal.

You have to enter your personal information, including your name, phone number, email address, home address and Social Insurance Number.

If you have a PIN provided by the claims administrator in your email or letter notice, you have to enter that as well.

Since compensation is based on time spent addressing issues related to the cyberattack, you have to report how many hours you spent communicating with government officials, law enforcement officials, or credit agencies about the breach.

If you are submitting an Access Claim and/or a Fraud Claim, you can also submit one Special Compensation Claim for out-of-pocket expenses related to the breach that were incurred within 12 months following the breach period.

But to receive compensation through the Special Compensation Fund, you must provide supporting documentation.

You don't have to provide proof or supporting documentation for an Access Claim or Fraud Claim.

Also, during the claims process, you have to select your preferred payment method: e-transfer, which is the fastest payment method, or cheque.

The deadline to submit a claim in this government of Canada privacy breach class action is February 3, 2027.

This article's cover image was used for illustrative purposes only.