Last Updated On 19 May 2026, 5:44 PM EDT (Toronto Time)
A new CRA settlement is now drawing major attention across Canada because eligible Canadians may be able to claim compensation of up to $5,000.
The settlement is connected to a class action involving Government of Canada online accounts, including Canada Revenue Agency accounts, My Service Canada accounts, and accounts accessed using GCKey.
The case stems from the 2020 credential stuffing attacks that affected federal online services and led to a class action against the Canada Revenue Agency and the Government of Canada.
The settlement has now been approved by the Federal Court, according to current reporting, but the claims process is not the same as a general payment for every Canadian.
Only eligible class members who meet the settlement requirements may receive compensation, and the highest amount is tied to documented out-of-pocket expenses related to the breach.
That means Canadians should understand who is covered, what kind of compensation may be available, and what to watch for before sharing personal information through any claim process.
Table of Contents
What Is The CRA Data Breach Settlement?
The settlement is part of the Sweet v. His Majesty the King class action.
The lawsuit was launched after the Government of Canada responded to credential stuffing attacks in August 2020 involving GCKey and CRA accounts.
Credential stuffing generally happens when attackers use usernames and passwords obtained from other breaches to try accessing accounts on another website or service.
The official Government of Canada notice says the case involves people whose personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1 and December 31, 2020.
Government of Canada online accounts include:
- CRA accounts
- My Service Canada accounts
- Other federal online accounts accessed using GCKey
The proposed settlement notice also says the Government of Canada denied wrongdoing and that the proposed settlement was a compromise of disputed claims, not an admission of liability or fault.
Why The CRA Settlement Is In The News Now
The settlement was proposed after the parties reached an agreement in 2025.
The official Government of Canada page said a settlement approval hearing was scheduled for March 31, 2026.
Daily Hive reported that the Federal Court approved the settlement on May 5, 2026, and that the federal government will pay $8.7 million to settle the class action.
That approval is why the story is now gaining attention again.
However, the official Canada.ca page and the KPMG settlement administrator page still contain language around the proposed settlement and approval process, so Canadians should carefully verify the latest claim instructions before submitting any personal information.
Who Could Be Eligible For The CRA Settlement?
Not every Canadian with a CRA account will qualify.
The official settlement notice says the class includes people whose personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1 and December 31, 2020.
However, that broader class definition does not mean every class member will receive money.
The notice says only class members who were victims of unauthorized access during the credential stuffing attack between June 15 and August 30, 2020, and whose information was accessed or accessed and used for fraudulent purposes, are entitled to payments under the settlement.
In simple terms, eligibility may depend on whether
- Your Government of Canada online account was affected
- Your personal or financial information was accessed
- Your information was used for fraudulent purposes
- You received notice from the claims administrator
- You can support the claim type you are making
The KPMG settlement administrator page also says people who received an email notice from the claims administrator are eligible to apply for payment under the settlement agreement.
How Much Can Eligible Canadians Claim?
The settlement includes different compensation categories. The highest amount is up to $5,000, but that amount is not automatic.
It applies to eligible class members who incurred qualifying out-of-pocket expenses related to the data breach.
| Compensation Category | Potential Amount | What It Means |
| Access Claims | Up to $80 | For time spent dealing with unauthorized access issues |
| Fraud Claims | Up to $200 | For time spent dealing with fraudulent use of personal information |
| Special Compensation Fund | Up to $5,000 | For eligible out-of-pocket expenses related to the breach |
The official notice says access claims may compensate eligible class members at $20 per hour for up to four hours, for a maximum of $80.
Fraud claims may compensate eligible class members at $20 per hour for up to ten hours, for a maximum of $200.
The Special Compensation Fund may reimburse up to $5,000 for eligible out-of-pocket expenses related to the breach.
The notice also warns that the precise amount of compensation may be reduced depending on the number of claims made.
Who Can Claim Up To $5,000?
The up to $5,000 amount is tied to the Special Compensation Fund.
This category is for eligible class members who incurred out-of-pocket expenses connected to the data breach.
The official notice lists examples such as
- Unreimbursed fraud losses or charges
- Professional or other fees connected to identity theft
- Fees or penalties resulting from credit freezes
That means the $5,000 amount is not a general flat payment. It is not guaranteed to every eligible person.
It is also not necessarily the amount every claimant will receive.
A person may need to show documentation proving that the expense was connected to the breach and that it was not already reimbursed elsewhere.
Why Not Everyone Will Receive $5,000
This is the most important part for readers to understand.
The headline amount is the maximum possible reimbursement under one compensation category.
- It does not mean every Canadian can claim $5,000.
- It does not mean every CRA account holder can claim $5,000.
- It does not mean every class member will receive $5,000.
The settlement notice states clearly that not all class members will be entitled to payments.
The strongest claims will likely depend on evidence such as the following:
- Proof of fraud loss
- Records showing identity theft-related expenses
- Communications with banks, credit agencies, law enforcement, or government departments
- Documentation showing fees or penalties
- Proof that losses were not reimbursed
CRA Settlement Eligibility At A Glance
| Question | What To Know |
| Is this for every Canadian? | No. It is limited to eligible class members. |
| Is this only for CRA accounts? | No. It can include CRA, My Service Canada, and GCKey-accessed accounts. |
| Is $5,000 automatic? | No. It is tied to qualifying out-of-pocket expenses. |
| Are claims currently open? | Readers should verify current instructions through official settlement channels. |
| Can amounts be reduced? | Yes. Compensation may be reduced depending on the number of claims. |
| Was wrongdoing admitted? | No. The government denied wrongdoing, and the settlement was a compromise of disputed claims. |
What Was This Credential Stuffing Attack?
The Government of Canada says it took action in August 2020 in response to credential-stuffing attacks on GCKey and CRA accounts.
Credential stuffing is different from a traditional system hack.
It usually involves attackers using login credentials obtained elsewhere to attempt access to accounts on another platform.
In this case, the class action focused on Government of Canada online accounts.
The official notice says affected accounts could include CRA accounts, My Service Canada accounts, and other accounts accessed through GCKey.
Some allegations in the lawsuit involved unauthorized access to account information and, in some cases, fraudulent benefit applications.
The Government of Canada denied wrongdoing.
What Affected Canadians Should Watch For Next
The official settlement notice previously said that after court approval, class members would be notified in writing about how to apply for compensation.
That makes the next step especially important.
Canadians should watch for official instructions from the settlement administrator, class counsel, or court-approved channels.
They should avoid entering personal information into random websites, social media links, or messages claiming to offer quick CRA settlement payments.
The KPMG administrator page lists contact details for the settlement process, including a toll-free number and email address.
Avoid CRA Settlement Scams
Any settlement involving CRA, personal information, SIN details, and possible compensation can attract scams.
Canadians should be careful with unexpected emails, texts, calls, and social media posts.
Before taking action, check whether the message comes from a recognized settlement administrator, class counsel, or official Government of Canada-linked source.
Be especially cautious if a message:
- Promises instant payment
- Asks for full banking login details
- Requests payment to unlock compensation
- Pressures you to act immediately
- Uses spelling errors or suspicious links
- Claims every Canadian can receive $5,000
The CRA does not ask for online banking passwords.
A legitimate claim process should not require people to pay a fee just to receive settlement compensation.
Documents That May Help A Claim
Eligible claimants seeking reimbursement from the Special Compensation Fund may need records that support their losses.
Useful documents may include:
- Bank statements showing unreimbursed fraud losses
- Credit card statements
- Identity theft recovery invoices
- Credit freeze fee records
- Letters from government departments
- Police reports
- Credit bureau correspondence
- Proof of time spent resolving the issue
- Communications with banks or service providers
This does not mean every document will be required in every case.
Final requirements should be checked against official claim instructions once available.
This settlement matters because many Canadians rely on online Government of Canada accounts for taxes, benefits, employment insurance, immigration services, pension information, and other essential programs.
The case also highlights how reused passwords and compromised credentials can create risks across multiple systems.
For Canadians, the practical lesson is simple.
Use strong passwords, avoid reusing passwords across websites, turn on multi-factor authentication where available, and monitor online government accounts regularly.
What Canadians Should Do Now
Canadians who think they may be affected should take a careful, step-by-step approach.
- Check whether they received notice from KPMG or class counsel
- Review the official Government of Canada page
- Verify any settlement website before entering personal information
- Gather records of any breach-related losses or expenses
- Watch for official claim instructions
- Avoid scam links promising instant CRA settlement money
Do not contact the CRA, ESDC, or other departments for settlement claim instructions if the official notice directs questions to class counsel or the claims administrator.
The Government of Canada notice says questions can be directed to Class Counsel, and the KPMG administrator page lists settlement administrator contact information.
The new CRA settlement could offer compensation of up to $5,000 per eligible Canadian, but only under specific conditions.
The largest amount is tied to qualifying out-of-pocket expenses connected to the 2020 Government of Canada online account breach.
Most readers should not assume they qualify automatically.
They should verify eligibility, watch for official claim instructions, protect their personal information, and prepare documentation if they believe they suffered a breach-related loss.
The key point is simple.
This is a real settlement connected to CRA and Government of Canada online accounts, but the $5,000 figure is a maximum reimbursement category, not a guaranteed payment for every Canadian.
Frequently Asked Questions (FAQs)
Can I still claim it if I changed my email address since 2020?
Possibly, but you should verify your status through the settlement administrator or class counsel. If the original notice went to an old email, you may need to use the official eligibility process or contact the administrator using verified contact details.
Will claiming money affect my taxes or CRA benefits?
Settlement payments can have different tax treatment depending on what they compensate. A reimbursement for out-of-pocket loss may be treated differently from other types of compensation. Anyone who receives payment should keep records and speak with a tax professional if unsure.
Can someone claim it if they were affected through My Service Canada instead of the CRA My Account?
Yes, the class definition is not limited only to CRA accounts. The official notice includes CRA accounts, My Service Canada accounts, and other Government of Canada online accounts accessed using GCKey. Eligibility still depends on the settlement requirements.
What if I suffered identity theft but never received a notice?
Not receiving a notice does not automatically prove someone is excluded, but it may affect how eligibility is verified. Affected individuals should use official settlement channels to confirm whether they are listed as eligible claimants.
Could the final payment be lower than the amount claimed?
Yes, the official notice says compensation may be reduced depending on the number of claims made. Claimants should treat $5,000 as a maximum reimbursement amount under the Special Compensation Fund, not a guaranteed payment.
Fact Checked: This article uses official Government of Canada settlement notices, the KPMG settlement administrator page, and current reporting on the Federal Court approval.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should verify eligibility and claim instructions through official settlement channels or class counsel.
Something went wrong. Please refresh the page and/or try again.
You may also like: New Canada Travel Warnings Now In Effect For 2026
New One-Time CRA Payment Confirmed For June 2026
New CRA Settlement Offers Up To $5,000 In Eligible Claims
New Canada Child Benefit Payment Coming On May 20