Canada CRA & GCKey Breach Settlement — Up to $5,200 CAD

Data Breach · Canada · Claims Open

Current Status

Claims are open. The claims period began August 4, 2026 and runs until February 3, 2027; the official notice gives no time of day, so file early. The Federal Court of Canada approved the settlement on May 5, 2026, so there is no further approval hearing. The deadline to opt out passed on February 20, 2026. No payment date had been announced as of September 24, 2026.

What Changed Recently?

The claims period opened on August 4, 2026, following the Federal Court of Canada's approval of the settlement on May 5, 2026 (Sweet v. His Majesty the King, 2026 FC 590, Justice Southcott). The action, Federal Court File No. T-982-20, had been certified as a class proceeding in 2022 (2022 FC 1228).

The case arose from two sets of incidents in 2020. From June 26 to August 18, 2020, attackers used credential stuffing — trying usernames and passwords stolen elsewhere — against CRA My Account, GCKey and Employment and Social Development Canada accounts. From October 8 to November 25, 2020, the CRA's Represent-a-Client portal was misused. The plaintiffs allege the Government of Canada failed to protect the personal and financial information held in those accounts. The Crown denies wrongdoing, and the settlement is not an admission of liability.

Who Qualifies?

The class is made up of all persons whose personal or financial information in a Government of Canada online account — including CRA My Account, My Service Canada and other accounts accessed with GCKey — was disclosed to a third party without authorization between March 1, 2020 and December 31, 2020.

Compensation is narrower than the class. Payments are available only for the two breach periods: June 26 to August 18, 2020 (the credential-stuffing attacks) and October 8 to November 25, 2020 (the Represent-a-Client misuse). People who opted out by February 20, 2026 are not part of the settlement. The class is not limited by where a person lives; it turns on whether their Government of Canada account was affected.

How Much Can You Get?

The Government of Canada is paying an all-inclusive $8,760,500.90 CAD, which covers class member compensation, administration and class counsel fees. Class members claim in up to two categories:

• Access claim — up to $80 CAD. For people whose account was accessed without authorization, paid at $20 CAD an hour for up to four hours of time spent dealing with it.
• Fraud claim — up to $200 CAD. For people whose account access led to fraud, paid at $20 CAD an hour for up to ten hours.
• Special Compensation — up to $5,000 CAD. Reimbursement of documented out-of-pocket costs incurred within 12 months of the breach period, available in addition to an Access or Fraud claim.

The most one person can receive is $5,200 CAD. Each category has its own pool: up to $2,720,000 CAD for Access claims, up to $2,800,000 CAD for Fraud claims, and $500,000 CAD plus any unused money for Special Compensation. If approved claims in a pool exceed what it holds, payments in that pool are reduced pro rata. Any money left over goes to the Privacy and Access Council of Canada.

The Court approved class counsel fees of $2,090,182.18 CAD plus $89,255.81 CAD in disbursements, paid from the settlement amount, along with honoraria for the representative plaintiffs.

What Proof or Notice ID Is Required?

No administrator-issued code is needed to get started. The claims portal checks eligibility against the government's breach records using either the PIN from a notice, if you received one, or your last name, email address and the last three digits of your Social Insurance Number.

Access and Fraud claims are paid at a set hourly rate. Special Compensation is different: it reimburses documented out-of-pocket costs, so receipts or other records of each expense are needed for that part of a claim.