If you used CRA My Account, My Service Canada Account, or any other Government of Canada portal back in 2020, you may be owed money. The claims portal for a major federal data breach settlement officially opened on August 4, 2026, and eligible Canadians now have until February 3, 2027 to file. Here’s exactly what happened, who qualifies, how much you could receive, and how to actually submit a claim.
What This Settlement Is About
Between June and August 2020, Canada faced a wave of credential-stuffing attacks — where hackers used stolen usernames and passwords (often leaked from unrelated data breaches elsewhere) to break into Government of Canada online accounts, including CRA My Account and GCKey-linked services. Attackers who got in were able to access sensitive personal information, including Social Insurance Numbers, home addresses, and banking details — and in some documented cases, used stolen credentials to file fraudulent CERB applications in victims’ names.
A class action followed, certified back in August 2022 under the case name Sweet v. His Majesty the King. On May 5, 2026, the Federal Court formally approved a $8,760,500.90 settlement, and after the mandatory 60-day appeal window closed without challenge, the claims process opened for real on August 4, 2026. The government has not admitted wrongdoing as part of the deal.
Who Qualifies
You’re considered a class member if your personal or financial information in a Government of Canada online account was accessed or shared without your authorization during the affected period, or if you received a direct notice from the claims administrator, KPMG. You may also qualify if you contacted the law firm Murphy Battista LLP about this breach before June 24, 2021.
Not everyone who simply had a CRA My Account during 2020 automatically qualifies — the settlement specifically covers people whose accounts were part of the confirmed unauthorized access incidents during the breach window. If you’re unsure whether you were affected, the safest step is checking directly through the official claims portal rather than assuming either way.
How Much You Could Receive
Compensation is split into tiers depending on how you were affected:
| Claim Type | What It Covers | Typical Amount |
|---|---|---|
| Access-only claim | Your info was accessed but not used fraudulently | Fixed compensation (around $80) |
| Fraudulent use claim | Your info was accessed and misused (e.g., fraudulent benefit applications) | Higher fixed compensation (around $200) |
| Special Compensation Fund | Documented out-of-pocket costs directly tied to the breach — credit monitoring fees, unreimbursed financial losses, etc. | |
| Up to $5,000, with supporting documentation |
These categories can stack — some claimants may be eligible for combined compensation of over $5,000 total if they qualify across more than one tier, though the $5,000 figure specifically applies to the documented-loss category and requires receipts, bank statements, or similar proof.
How to File Your Claim
- Go to the official portal: breachsettlementcanada.kpmg.ca — this is the only legitimate claims site, administered by KPMG.
- Confirm your class membership using the details requested on the portal (this typically includes information tied to your Government of Canada online account usage during 2020).
- Select your claim category — access-only, fraudulent use, or the Special Compensation Fund — based on how you were personally affected.
- Upload supporting documentation if you’re claiming under the Special Compensation Fund. Bank statements, credit monitoring receipts, or records of fraudulent activity strengthen a documented-loss claim.
- Submit before February 3, 2027. Claims submitted after the deadline will not be accepted.
Watch Out for Scams
The publicity around this settlement has already attracted fraud. Scam text messages and emails falsely claiming recipients are owed a CRA data breach payout have been circulating since the news broke, and none of them are connected to the real legal process. A few rules of thumb:
- The only legitimate claims portal is breachsettlementcanada.kpmg.ca — never click a link from an unsolicited text or email.
- The real process never asks you to pay a fee upfront to “release” your settlement money.
- The CRA and KPMG will not ask for your full banking password or online banking login credentials through text or email.
If you’re worried your CRA My Account security was compromised back in 2020 and want to tighten things up now, our guide on Common CRA Login Problems in 2026 covers account access and troubleshooting. And since the original breach exposed home addresses and banking details for some victims, it’s worth double-checking that your address and direct deposit banking information on file with the CRA are both current and correct.
If Your SIN Was Compromised
Some victims of the 2020 breach had their Social Insurance Numbers exposed. If you believe yours was compromised and you’re concerned about ongoing identity theft risk, replacing your SIN card is a separate process from this settlement — see our guide on How to Replace a Lost or Damaged SIN Card in Canada for the steps, though note that a compromised (but not physically lost) SIN involves contacting Service Canada directly to flag potential misuse.
Frequently Asked Questions
Do I need to have received a notice from KPMG to file a claim?
No. While receiving a notice confirms class membership, you can also qualify if your account was affected during the breach window even without a direct notice — check the official portal to confirm your status.
Is there a cost to file a claim?
No. Filing through the official KPMG portal is free. Any message asking for payment to process your claim is a scam.
What’s the deadline to file?
February 3, 2027. Claims submitted after this date will not be accepted.
Can I claim under more than one compensation category?
Yes, if your circumstances qualify for more than one tier — for example, both a fraudulent-use claim and a documented financial loss under the Special Compensation Fund.
Pingback: Canada Benefit Payment Dates — September 2026