Canadians can now claim up to $5,280 for 2020 federal government credential-stuffing breach

Canadians whose government accounts were compromised during credential-stuffing attacks in 2020 can now file claims for compensation worth up to $5,280 through a federally approved settlement.

The claims portal opened August 4 for victims of attacks that struck CRA My Account, My Service Canada Account, and other services accessed through GCKey between June 15 and August 30, 2020. Unauthorized parties accessed personal accounts and in some cases used the stolen information to file fraudulent Canada Emergency Relief Benefit and Canada Emergency Student Benefit claims.

The Federal Court approved an $8.76 million settlement on May 5, 2026 in the case Sweet v. His Majesty the King. The government denies wrongdoing.

Compensation is structured in three categories: access claims up to $80 for time spent addressing unauthorized access; fraud claims up to $200 for time spent addressing fraudulent use; and a special compensation fund up to $5,000 for out-of-pocket losses like unreimbursed fraud or identity-theft costs. The combined maximum across all three is $5,280.

Those contacted directly by KPMG, the claims administrator, with a personal identification number are already confirmed eligible. Others can check eligibility online using their last name, the last three digits of their Social Insurance Number, and the email address tied to their government account. Claims can be submitted online or by mail; e-transfer payouts process faster than cheques.

The source does not state how many class members are eligible overall.