New CRA My Account Breach Settlement Claims Now Open For Up To $5,000

Last Updated On 6 August 2026, 6:45 PM EDT (Toronto Time)

A major government settlement linked to compromised CRA and Service Canada accounts is now accepting compensation claims from affected Canadians.

The claims portal went live on August 4, 2026, giving eligible class members their first opportunity to file for payouts that could reach thousands of dollars.

This settlement stems from a series of cyberattacks that struck federal online accounts during 2020 and exposed personal and financial information belonging to thousands of Canadians.

The window to submit a claim will remain open for approximately six months, and the process involves specific eligibility requirements that not every Canadian will meet.

Here is everything you need to know about who qualifies, how much you could receive, and exactly how to file your claim before the deadline.

What Happened And Why Claims Are Open Now

The Government of Canada officially opened the claims portal for the CRA privacy breach class action settlement on August 4, 2026.

This means eligible Canadians can now go to the KPMG settlement website and submit their compensation claims online for the first time.

The Federal Court approved the $8.7 million settlement on May 5, 2026, following a settlement approval hearing held on March 31, 2026.

The 60-day appeal window has now closed without any challenges being filed, which is why the portal opened in early August.

KPMG is serving as the official claims administrator and is responsible for processing all submitted claims.

The Government of Canada updated its official settlement page on August 4, 2026, confirming that claims can now be submitted through the KPMG portal at breachsettlementcanada.kpmg.ca.

CRA Breach Settlement Eligibility

Not every Canadian with a CRA My Account or My Service Canada Account is eligible to receive money from this settlement.

The class definition covers all persons whose personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020.

Government of Canada online accounts covered by this settlement include CRA My Account, My Service Canada Account, and any other federal online account accessed using GCKey.

However, being part of the class does not automatically entitle you to compensation.

The official settlement approval notice makes clear that payments are limited to two specific groups.

The first group includes class members whose Government of Canada online accounts were subject to unauthorized access by third parties during the credential stuffing attacks between June 26 and August 18, 2020.

The second group includes class members whose personal and financial information was accessed by an unauthorized third party using a Represent a Client (RAC) account between October 8 and November 25, 2020.

This second category involving RAC accounts is a detail that many news reports have overlooked but is critical for tax professionals and accountants whose client information may have been compromised through their representative access.

If you received an email or letter from KPMG with a personal identification number (PIN), you are likely eligible to apply for compensation.

Canadians who did not receive a notice can still check their eligibility on the KPMG portal using their last name, the last three digits of their Social Insurance Number, and the email address linked to their government online account.

The eligibility checker has been available on the KPMG portal since January 15, 2026, well before the claims portal itself opened.

Eligibility Summary

Question	Answer
Is every Canadian eligible?	No, only class members whose accounts were breached during the defined periods
Which accounts are covered?	CRA My Account, My Service Canada Account, and GCKey-accessed accounts
What about RAC accounts?	Yes, breaches through Represent a Client accounts between October 8 and November 25, 2020, are included
Is a KPMG notice required?	Not necessarily, but receiving one is a strong indicator of eligibility
Can I check eligibility online?	Yes, through breachsettlementcanada.kpmg.ca since January 15, 2026
Was there an opt-out deadline?	Yes, February 20, 2026, and it has passed

If you did not opt out by the February 20, 2026, deadline, you are automatically bound by the terms of the settlement regardless of whether you participate in the claims process.

Compensation Categories And Maximum Amounts

The settlement divides compensation into three distinct categories, each with its own maximum payout and eligibility criteria.

Understanding these categories is essential because the widely reported $5,000 figure applies only to one specific type of claim and requires supporting documentation.

Access Claims — Up To $80

This category compensates eligible class members whose personal information was accessed by an unauthorized third party but was not used for fraudulent purposes.

Compensation is calculated at $20 per hour for up to four hours of time spent dealing with issues related to the unauthorized access.

That means the maximum payout under this category is $80.

You do not need to provide proof or supporting documentation to file an Access Claim.

This category is designed for people who spent time contacting government officials, monitoring their accounts, or changing passwords and security settings after learning their account had been compromised.

Fraud Claims — Up To $200

This category is for eligible class members whose personal information was not only accessed but also used fraudulently by a third party.

Examples of fraudulent use include unauthorized applications for CERB benefits, CESB benefits, Employment Insurance benefits, or situations where government benefit payments were diverted to unauthorized bank accounts.

Compensation under the Fraud Claim is calculated at $20 per hour for up to 10 hours.

The maximum payout for this category is $200.

You do not need to provide proof or supporting documentation for a Fraud Claim either.

During the claims process, you will be asked to report how many hours you spent communicating with government officials, law enforcement, or credit agencies about the fraudulent activity.

Special Compensation Fund — Up To $5,000

This is the highest-value compensation category and the source of the $5,000 figure that has generated the most public attention.

The Special Compensation Fund reimburses eligible class members for qualifying out-of-pocket expenses that were directly related to the data breach.

Eligible expenses under this category include unreimbursed fraud losses or charges, professional or other fees related to identity theft recovery, and fees or penalties resulting from credit freezes.

Unlike Access Claims and Fraud Claims, the Special Compensation Fund requires supporting documentation to prove your expenses.

The maximum reimbursement is $5,000, but this is not a guaranteed flat payment for every eligible person.

You must demonstrate that the expense was connected to the breach and that you were not already reimbursed through another channel.

Eligible claimants may receive up to $80 for an Access Claim or up to $200 for a Fraud Claim, plus as much as $5,000 for documented eligible expenses.

Compensation Breakdown At A Glance

Category	Maximum Amount	Rate	Documentation Required
Access Claim	$80	$20/hour, up to 4 hours	No
Fraud Claim	$200	$20/hour, up to 10 hours	No
Special Compensation Fund	$5,000	Reimbursement of eligible expenses	Yes
Combined Maximum	$5,200	All three categories	Partial (Special Fund only)

The settlement notice also warns that actual payment amounts may be reduced depending on the total number of approved claims submitted across all class members.

Step-By-Step Guide To Filing Your Claim Online

The KPMG claims portal is the primary channel for submitting your compensation claim, and online submissions will be processed faster than paper claims.

Here is exactly how to file your claim through the portal.

Step 1: Visit the official claims portal at breachsettlementcanada.kpmg.ca and click the “Apply for Compensation” button.
Step 2: Create an account or sign in using your email address to access the claims portal.
Step 3: Enter your personal information, which includes your full name, phone number, email address, home address, and Social Insurance Number.
Step 4: Enter your PIN if you received one by email or letter from the claims administrator.
Step 5: Select your claim type and indicate whether you are filing an Access Claim, a Fraud Claim, a Special Compensation Fund Claim, or a combination.
Step 6: Report your hours spent communicating with government officials, law enforcement officials, or credit agencies about the breach for Access and Fraud Claims.
Step 7: Upload supporting documentation if you are filing a Special Compensation Fund Claim for out-of-pocket expenses.
Step 8: Choose your payment method between Interac e-Transfer, which is the fastest option, or a mailed cheque.
Step 9: Review and submit your completed claim form.

If you are unable to submit a claim online, you can download a paper claim form from the documents section of the KPMG settlement website and mail it to the claims administrator.

The mailing address for paper claims is KPMG, 600 de Maisonneuve Blvd. West, Suite 1500, Tour KPMG, Montréal, Quebec, H3A 0A3, Attention: Canada Privacy Breach Class Action Administrator.

Key CRA Data Breach Settlement Dates And Deadlines

The following timeline shows every critical date connected to the CRA data breach class action settlement from start to finish.

Date	Event
March 1 – December 31, 2020	Period covered by the class definition
June 26 – August 18, 2020	Credential stuffing attack breach period
October 8 – November 25, 2020	RAC account breach period
August 25, 2022	The federal court certified the class action
January 15, 2026	The eligibility checker went live on KPMG portal
February 20, 2026	Opt-out deadline (now passed)
March 31, 2026	Settlement approval hearing held
May 5, 2026	The federal court approved the settlement
August 4, 2026	The claims portal opened for submissions
February 3, 2027	Deadline to submit all claims

Claims submitted after February 3, 2027, may not be eligible for compensation under any category.

That gives eligible Canadians approximately six months from the portal opening to gather their documentation and file.

Documents That Could Strengthen Your Claim

Access Claims and Fraud Claims do not require supporting documentation, but the Special Compensation Fund does.

If you plan to file for reimbursement of out-of-pocket expenses, gathering these records now will help you submit a stronger claim before the February 2027 deadline.

Useful documents may include:

Bank statements showing unreimbursed fraud losses
Credit card statements reflecting unauthorized charges
Invoices from identity theft recovery services
Records of credit freeze fees charged by credit bureaus
Correspondence with government departments about the breach
Police reports filed in connection with the identity theft
Letters from banks or financial institutions confirming fraudulent transactions
Receipts for any fees or penalties you incurred as a direct result of the breach

Not every document will be required in every case, and the specific requirements will depend on what type of expense you are claiming.

The settlement notice does not provide a fixed list of mandatory documents, so claimants should include anything that clearly links their expense to the 2020 data breach.

What Happens After You Submit Claim

The claims administrator at KPMG will review each submitted claim to verify eligibility and assess the compensation amount.

Online claims are expected to be processed faster than paper submissions mailed to the Montréal office.

If your claim is approved, payment will be issued through the method you selected during the filing process, either Interac e-Transfer or cheque.

The settlement notice does not specify an exact timeline for when payments will be distributed after claims are reviewed.

However, based on the structure of similar Canadian class action settlements like the Scotiabank NSF fee settlement and the Canada Bread settlement, distributions typically begin several months after the claims deadline closes.

Claimants should save a copy or screenshot of their submitted claim for their personal records.

How Much Money Will Claimants Actually Receive

The maximum combined payout of $5,200 per eligible class member is a ceiling, not a guarantee.

Several factors will determine how much any individual claimant actually receives.

First, the total settlement fund is $8,760,500.90, and that amount is fixed regardless of how many claims are filed.

Second, class counsel fees of 33.33% of the net settlement proceeds have been approved by the court, along with disbursements, taxes, and administration expenses.

The court also approved honoraria of $5,000 for representative plaintiff Todd Sweet and $1,500 each for Anne Campeau and Tanis Seminoff, two additional class members who contributed to the litigation.

After legal fees, administration costs, and honoraria are deducted from the gross settlement, the remaining funds are divided among all approved claimants.

If the total value of all approved claims exceeds the available funds, each claimant’s payment will be reduced proportionally.

This means a person who qualifies for the full $80 Access Claim might receive somewhat less than $80 if thousands of other class members also file valid claims.

The actual payout per person will depend entirely on how many eligible Canadians submit claims and for which categories they apply.

Where The $8.7 Million Settlement Fund Goes

Understanding the full breakdown of the settlement fund helps explain why individual payouts may be lower than the maximum advertised amounts.

Allocation	Details
Total Settlement Fund	$8,760,500.90
Class Counsel Legal Fees	33.33% of net proceeds
Plaintiff Honorarium (Todd Sweet)	$5,000
Honoraria (Campeau and Seminoff)	$1,500 each
Administration Expenses	Deducted before distribution
Remaining for Claimants	Divided proportionally among approved claims

The class counsel fee structure means that roughly one-third of the net settlement proceeds goes to the law firm that litigated the case over approximately six years.

This is a standard contingency fee arrangement in Canadian class action litigation and was reviewed and approved by the Federal Court.

How To Check Your Eligibility Right Now

The KPMG eligibility checker has been live since January 15, 2026, and is separate from the claims submission portal that opened on August 4.

To check your eligibility, visit breachsettlementcanada.kpmg.ca and navigate to the eligibility section.

You will need to enter your last name, the last three digits of your Social Insurance Number, and the email address associated with your Government of Canada online account.

The system will confirm whether you are listed as an eligible class member in the settlement administrator’s records.

If you are confirmed as eligible, you can proceed directly to the claims portal to submit your compensation claim.

If the checker does not confirm your eligibility but you believe your account was breached during the defined periods, you can contact the claims administrator by email at breachsettlementcanada@kpmg.ca, by phone at 1-833-724-6160, or by fax at 514-840-2390.

You can also reach class counsel at Rice Parsons Leoni & Elliott LLP by email at classactions@rplelaw.com or by mail at Suite 820, 980 Howe Street, Vancouver, British Columbia, V6Z 0C8.

How To Avoid CRA Settlement Scams

Any settlement involving CRA accounts, Social Insurance Numbers, and financial compensation is a high-value target for scammers and fraudsters.

The timing of this portal opening will likely trigger a wave of phishing emails, text messages, and social media posts designed to steal personal information from Canadians who believe they may be eligible.

Here is how to protect yourself.

The only legitimate website for submitting a claim is breachsettlementcanada.kpmg.ca, and any other domain requesting your SIN or personal details in connection with this settlement should be treated with extreme caution.

The CRA will never ask for your online banking passwords or credit card numbers or demand immediate payment to process a settlement claim.

No legitimate claims process requires you to pay a fee upfront to receive compensation.

Be suspicious of any message that promises a guaranteed $5,000 payment, pressures you to act within hours, uses spelling errors or unusual formatting, or arrives through unofficial channels like social media direct messages.

If you receive a suspicious communication claiming to be related to this settlement, report it to the Canadian Anti-Fraud Centre at 1-888-495-8501 or online through the CAFC reporting portal.

Scam warning signs to watch for include messages claiming every Canadian is eligible for $5,000, requests for full banking login credentials, demands for payment to unlock your settlement money, and links to websites that mimic but do not match the official KPMG domain.

What This Means For Canadians Using Government Online Accounts

The credential stuffing attacks of 2020 exposed a structural vulnerability in how millions of Canadians access their tax, benefit, and pension information online.

CRA My Account, My Service Canada Account, and GCKey are used by millions of residents to manage income tax filings, track benefit payments, view CPP and OAS pension statements, apply for Employment Insurance, and access immigration case status through IRCC.

The 2020 attacks used credentials leaked from other data breaches to attempt login access to these government portals, a technique known as credential stuffing.

This type of attack exploits Canadians who reuse the same password across multiple websites and services.

Since the breach, the Government of Canada has implemented additional security measures, including multi-factor authentication options on GCKey and CRA accounts.

Canadians can protect themselves going forward by using a unique password for every government account, enabling multi-factor authentication wherever it is offered, monitoring their CRA My Account and My Service Canada Account regularly for any unauthorized changes, and running credit checks through Equifax or TransUnion to detect signs of identity theft.

The Capital One data breach settlement currently working its way through the courts in British Columbia is another example of how large-scale data compromises continue to affect Canadians and produce class action litigation.

These settlement processes can take years from breach to payout, which is why documenting any losses immediately after a breach is essential for maximizing future claim value.

The CRA breach settlement is a reminder that digital security is directly tied to financial security for every Canadian who relies on online government services.

Frequently Asked Questions (FAQs)

Can I file a claim if I changed my SIN after the 2020 breach?

Changing your SIN after experiencing identity theft is a step some Canadians took following the 2020 breach, and it does not automatically disqualify you from filing a claim. However, the eligibility checker on the KPMG portal uses your last name, the last three digits of your SIN, and your email address to verify your status. If your SIN has changed since the breach, the system may not match your records automatically. In that situation, contact the claims administrator directly at breachsettlementcanada@kpmg.ca or call 1-833-724-6160 to explain your circumstances and confirm your eligibility manually.

Will receiving settlement compensation trigger a CRA tax reassessment or affect my benefit payments?

Settlement compensation can have different tax treatment depending on what it compensates. Reimbursement of documented out-of-pocket losses under the Special Compensation Fund is generally not treated the same as employment or investment income. However, the CRA has not issued specific guidance on the tax treatment of payments from this particular settlement. Recipients should keep all documentation related to their claim and settlement payment and consult a tax professional if they are concerned about potential effects on income-tested benefit programs.

What happens if the total approved claims exceed the settlement fund after legal fees are deducted?

The settlement agreement includes a proportional reduction mechanism. If the combined value of all approved claims is greater than the available funds remaining after class counsel fees, administration costs, and honoraria are deducted, every approved claimant receives a reduced payment calculated on a pro-rata basis. This means a person who filed for the full $80 Access Claim and the full $200 Fraud Claim might receive a proportionally smaller amount if the fund is oversubscribed. The exact reduction percentage will not be known until all claims have been reviewed and approved.

Can a power of attorney or legal representative file a claim on behalf of a deceased class member?

The settlement approval notice does not explicitly address claims filed on behalf of deceased class members. In Canadian class action litigation, estates of deceased persons who were class members at the time of the breach may still be entitled to file claims through an authorized legal representative. If the affected person passed away after the 2020 breach but before the claims portal opened, the estate executor or power of attorney holder should contact class counsel at Rice Parsons Leoni & Elliott LLP to determine whether a claim can be submitted and what documentation may be required.

Does this settlement prevent me from suing the Government of Canada separately over the same breach?

Yes, the opt-out deadline was February 20, 2026, and it has passed. If you did not submit an opt-out form before that date, you are bound by the terms of the settlement regardless of whether you file a claim. This means you have permanently given up your right to individually sue the Government of Canada for claims related to this specific data breach. Filing a claim under the settlement is your only remaining avenue for compensation. Canadians who opted out before the deadline retain the right to pursue independent legal action but are not eligible for any payments under this settlement.

Fact-Checked: All settlement details, compensation amounts, eligibility criteria, and claim deadlines verified against the official Government of Canada settlement approval notice (updated August 4, 2026), the Federal Court-authorized Notice of Settlement Approval for Sweet v. His Majesty the King (Federal Court File No. T-982-20), and the KPMG settlement administrator portal at breachsettlementcanada.kpmg.ca.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should verify eligibility and claim instructions through the official KPMG settlement portal or contact class counsel at Rice Parsons Leoni & Elliott LLP.

Gagandeep Kaur Sekhon

Gagandeep Kaur Sekhon moved to Canada in 2010 on a study visa. She navigated through the ups and downs of her student life and gained her permanent residency in 2015. Today, she is a proud Canadian citizen residing in Calgary, Alberta. She is mother of 2 beautiful daughters and making her difference through writing and guidance at INC – Immigration News Canada.