Canadians affected by 2020 data breach can now claim up to $5,000
Class-action settlement opens for those whose government accounts were compromised during credential-stuffing attacks.
The day's top stories, food & events — every morning at 7. Unsubscribe anytime.
Canadians whose personal and financial information was fraudulently accessed through Government of Canada online accounts in 2020 can now file claims for compensation up to $5,000, with a deadline of February 3, 2027.
The class-action lawsuit, Sweet v. His Majesty the King, reached an $8.7 million settlement last December and received court approval in May. Claims are now open through KPMG, the settlement administrator.
The 2020 breach affected Canada Revenue Agency "My Account" accounts, My Service Canada accounts, and other Government of Canada online accounts accessed using GCKey. Hackers used credential-stuffing attacks to access personal information including Social Insurance Numbers, home addresses, and banking information. Some of the compromised information was used to fraudulently apply for government benefits.
To be eligible, you must have received a notification email from KPMG, or you can check eligibility through the KPMG portal. Class members can receive up to $80 for time spent addressing unauthorized access, up to $200 for time spent addressing fraudulent use of personal information, and up to $5,000 for out-of-pocket expenses related to the breach, such as unreimbursed fraud losses and identity theft costs.
The Government of Canada denies wrongdoing but agreed to the settlement as a compromise. Eligible claimants can submit claims online or by mail until February 3, 2027. The exact per-person payout will depend on the total number of valid claims filed and how funds are distributed among claimants.
How many Canadians are part of the eligible class for this settlement?
What is the expected per-person payout amount given the $8.7 million pool?
We'll update this story as answers emerge.
By the numbers
How much can affected Canadians claim from the 2020 data breach settlement?
Eligible claimants can receive up to $80 for time spent addressing unauthorized access, up to $200 for time spent addressing fraudulent use of personal information, and up to $5,000 for out-of-pocket expenses related to the breach, such as unreimbursed fraud losses and identity theft costs.
When is the deadline to file a claim?
February 3, 2027 is the deadline for eligible claimants to submit claims online or by mail.
