Canadians affected by 2020 CRA data breach can claim up to $5,280
A federal court approved an $8.76M settlement for people whose login credentials were stolen in credential-stuffing attacks on government online accounts.
Sources · local media reports
The day's top stories, food & events — every morning at 7. Unsubscribe anytime.
Thousands of Canadians caught up in a 2020 data breach affecting CRA and Service Canada accounts can now file claims for compensation. The Federal Court approved an $8,760,500.90 settlement on May 5, 2026, to compensate people whose personal and financial information was exposed when hackers used credential-stuffing attacks to access government online accounts.
The breach hit between March 1 and December 31, 2020, but actual payouts are limited to people whose information was accessed during the narrower window of June 15 to August 30, 2020. Some victims had their login details used to file fraudulent CERB applications. If KPMG, the settlement administrator, already emailed you directly, you're covered. You can also check eligibility at breachsettlementcanada.kpmg.ca using your last name, the last three digits of your SIN, and the email address tied to your government account.
Compensation breaks into three categories: up to $80 for time spent dealing with unauthorized account access, up to $200 for addressing fraudulent use of personal information, and up to $5,000 for out-of-pocket costs directly tied to the breach — receipts or bank statements required. The maximum a single claimant can receive is $5,280. Actual payouts depend on how many valid claims are filed; if claims exceed what's left in the fund, individual amounts will be lower.
The claims portal hasn't opened yet. Based on the settlement timeline, it's expected to go live 60 days after the appeal deadline passes without challenge. Once live, eligible Canadians will have a six-month window to file through breachsettlementcanada.kpmg.ca or by calling 1-833-724-6160. Processing takes the standard 20 business days. Be alert: scam texts and emails claiming you're eligible for a "CRA data breach payout" have started circulating. KPMG and the CRA will never ask you to pay a fee to access settlement funds.
When will the claims portal actually open and how long do I have to file?
How much will I actually receive if thousands of people claim at once?
What counts as valid documentation for the $5,000 out-of-pocket category?
We'll update this story as answers emerge.
By the numbers
How much was the settlement approved for?
The Federal Court approved an $8,760,500.90 settlement on May 5, 2026, for people affected by the 2020 data breach.
What's the maximum compensation a single person can receive?
The maximum a single claimant can receive from the settlement is $5,280, made up of three categories: up to $80 for time spent dealing with unauthorized access, up to $200 for addressing fraudulent use of personal information, and up to $5,000 for out-of-pocket costs directly tied to the breach.
When will the claims portal open?
The claims portal is expected to go live 60 days after the appeal deadline passes without challenge, though no specific date has been set yet.
How long will eligible people have to file a claim?
Once the claims portal opens, eligible Canadians will have a six-month window to file through breachsettlementcanada.kpmg.ca or by calling 1-833-724-6160.
