Thousands of Canadians affected by the 2020 government-account breach may qualify for compensation. Here’s how to check your eligibility before the February 3, 2027 deadline.
If something suspicious happened to your CRA or Service Canada account during the pandemic, it may finally be worth money.
A court-approved settlement is now accepting claims from eligible Canadians whose personal information was accessed during the 2020 cyberattacks targeting CRA My Account, My Service Canada and other GCKey-linked accounts.
Depending on what happened and the costs you incurred, you could claim compensation ranging from $80 to as much as $5,000. But this isn’t an automatic payment—and not everyone whose account was affected will qualify.
Why Canadians are being offered compensation
In 2020, attackers used credentials stolen from other websites to attempt logins on Government of Canada portals. This technique, known as “credential stuffing,” can work when someone reuses the same password across multiple services.
After accessing certain accounts, attackers reportedly changed personal or banking information and submitted fraudulent applications for benefits such as CERB.
The incident eventually led to the class-action lawsuit Sweet v. His Majesty the King. The Federal Court approved the settlement in May 2026, although the Government of Canada continues to deny wrongdoing. Canada’s official settlement notice confirms that compensation claims are now open.
How much could you receive?
The amount depends on how the breach affected you:
- Up to $80 for account-access problems: Eligible claimants may receive $20 per hour for as many as four hours spent contacting government departments, police or credit agencies.
- Up to $200 for fraud-related problems: If stolen information was used for fraudulent benefit applications or diverted payments, compensation may cover as many as 10 hours at $20 per hour.
- Up to $5,000 for documented expenses: This can include unreimbursed fraud losses, identity-theft-related professional fees and certain charges connected with credit freezes.
These are maximum amounts—not guaranteed payouts. Compensation may be reduced if the total value of approved claims exceeds the available settlement funds. The official administrator’s notice contains the complete compensation terms.
Who is actually eligible?
This is the part many headlines leave out: the settlement does not promise $5,000 to every Canadian with a CRA account.
According to the claims administrator, payments are generally limited to identifiable individuals whose information was accessed during the credential-stuffing attacks. The covered services include:
- CRA My Account
- My Service Canada Account
- Other Government of Canada accounts accessed through GCKey
Receiving an official notice from KPMG is a strong indication that you can apply. If you did not receive one, you can still use the administrator’s eligibility checker to find out whether your name appears among the affected accounts.
- → Heading to Border Control? Key Immigration Questions You Must Be Ready to Answer
- → Planning a European Trip? What Starkville’s Indian Community Should Know About Schengen Visas
- → 11 Countries Offering Funded Ph.D. Programs for International Students
- → U.S. Dollar Reaches Two-Week High Driven by Middle East Tensions and Fed Policy Outlook
- → 100-Year-Old Who Still Drives and Lives Alone Shares Her 6 Secrets to Longevity
- → What to Do Immediately If a Family Member Is Detained by ICE in Indiana
- → Flying With Flour or Coffee? TSA’s Powder Rule Could Delay Your Airport Security Screening
What you should do now
First, visit the official KPMG settlement portal and complete its eligibility check.
If you qualify, gather anything that could support your claim: CRA correspondence, bank statements, invoices, fraud reports, credit-monitoring receipts and records of the time you spent resolving the problem. Claims involving out-of-pocket losses will require stronger documentation than claims for time and inconvenience.
Submit the completed claim online or by mail no later than February 3, 2027.
Be careful with links sent through unsolicited emails or social-media posts. This settlement involves sensitive identity information, so confirm that you are on the official KPMG domain before entering anything. You should never have to pay a fee to unlock your compensation.
This is not free money for every taxpayer. But if your CRA, Service Canada or GCKey-linked account was compromised during the 2020 attacks, ignoring the settlement could mean leaving legitimate compensation unclaimed.
A quick eligibility check could tell you whether you qualify for $80, $200 or reimbursement of documented losses worth as much as $5,000—and the deadline is already approaching.
