Canadians whose government accounts were compromised during the 2020 cyberattacks can now apply for compensation. The claims portal for the CRA data breach settlement opened on August 4, following Federal Court approval of an $8.7 million settlement on May 5, 2026, and claims must be submitted by February 3, 2027.
Headlines have focused on the $5,000 figure, but that is the ceiling on a documented expense claim rather than a cheque waiting to be collected. Most people who qualify will receive $80. Here is what the settlement actually pays, who is covered, and where the widely reported eligibility dates are wrong.
What the CRA Data Breach Settlement Pays
Compensation is split into three categories, and the amounts are calculated as an hourly rate for time lost rather than as damages.
An Access Claim covers class members whose information was viewed but not used fraudulently. It pays $20 per hour for up to four hours, capping at $80. This is the category most eligible people fall into, and it is meant to compensate for time spent contacting officials, changing passwords or monitoring accounts afterward.
A Fraud Claim applies where information was accessed and then used, for example when fraudulent CERB, CESB or Employment Insurance applications were filed in someone’s name, or benefit payments were redirected to an unauthorized account. It pays the same $20 per hour for up to ten hours, capping at $200.
The Special Compensation Fund is the tier behind the $5,000 headline. It reimburses documented out of pocket expenses tied to the breach, specifically unreimbursed fraud losses or charges, professional or other fees relating to identity theft, and fees or penalties resulting from credit freezes. Unlike the first two categories, this one requires supporting documentation.
The settlement notice is explicit that payment amounts may be reduced depending on how many claims are approved, so the published maximums are not guaranteed.
The Eligibility Dates Most Coverage Has Wrong
This is where it pays to read the court notice rather than the news write ups. Several outlets have reported the qualifying window as June 15 to August 30, 2020, and at least one has reported August 13. The notice authorized by the Federal Court gives different dates.
Compensation is limited to two groups. The first is class members whose accounts were subject to unauthorized access during the credential stuffing attacks between June 26 and August 18, 2020. The second is class members whose information was accessed by an unauthorized third party through a Represent a Client account between October 8 and November 25, 2020.
That second category has been almost entirely absent from coverage, and it matters. Represent a Client is the portal accountants and authorized representatives use to access taxpayer files, so people who never had their own credentials stolen may still qualify.
Class membership itself is broader than the compensation window. The class covers anyone whose personal or financial information in a Government of Canada online account was disclosed without authorization at any point between March 1 and December 31, 2020. Being in the class does not by itself entitle you to a payment.
Which Accounts Are Covered
The settlement is not limited to the CRA. A Government of Canada online account means a Canada Revenue Agency account, a My Service Canada account, or any other federal online account accessed using the GCKey credential service.
You may also apply if you received a notice from KPMG, the court appointed claims administrator, by email or mail.
How to Check Your Eligibility and File
Eligibility can be confirmed directly. The settlement site has had an eligibility checker running since January, and confirming your status takes your last name and the last three digits of your social insurance number.
Claims are submitted at breachsettlementcanada.kpmg.ca. Online filing is processed faster than paper, though claims can also be sent by mail or fax, and the administrator can be reached toll free at 1-833-724-6160.
If you are filing under the Special Compensation Fund, start assembling records now. You will need to show the expense was connected to the breach and that you were not reimbursed elsewhere, which means bank or credit card statements, invoices from identity theft services, and credit bureau correspondence.
One practical note. Filing early is sensible given the pro rata reduction clause, since the size of the eventual payment depends on total approved claims.
Watch for Scams
Settlement announcements reliably attract fraud, and the irony of a data breach settlement being used as bait is not lost on anyone. The legitimate portal is the KPMG address above. No legitimate administrator will ask for your full social insurance number, your banking password, or a fee to process a claim.
Background to the Case
The case is Sweet v. His Majesty the King, Federal Court File No. T-982-20 (2026 FC 590), certified in August 2022 and approved by the Federal Court on May 5, 2026. The claim was that the government failed to properly safeguard confidential information accessed through federal portals, and that inadequate safeguards let bad actors view accounts and in some cases apply for CERB.
The government denies the allegations and the settlement is not an admission of liability or fault. The opt out deadline passed on February 20, 2026, so anyone who did not opt out is bound by the settlement.
Class counsel, Rice Parsons Leoni & Elliott LLP (formerly Rice Harbut Elliott LLP), sought fees of 33.33 percent of net settlement proceeds plus disbursements, taxes and administration expenses, which the court approved.
Frequently Asked Questions
What is the deadline to claim?
February 3, 2027. Claims submitted after that date may not be eligible for compensation under any category.
Will everyone affected get $5,000?
No. The $5,000 is the maximum reimbursement for documented out of pocket expenses. Most eligible claimants fall into the Access Claim category, which caps at $80.
Do I need documentation to file?
Not for Access Claims or Fraud Claims. The Special Compensation Fund does require proof that the expense was related to the breach and was not reimbursed elsewhere.
I had a CRA account in 2020 but was never notified. Do I qualify?
Possibly. Check the eligibility tool on the settlement site rather than assuming either way, since compensation is tied to specific access periods rather than to having held an account.
Is the compensation taxable?
Settlement amounts of this kind generally compensate for inconvenience and out of pocket loss rather than income. Anyone claiming a substantial amount under the Special Compensation Fund should confirm the treatment with a tax professional.
Details verified against the Notice of Settlement Approval authorized by the Federal Court of Canada and published by the Treasury Board of Canada Secretariat on August 4, 2026. Last updated: August 2026.