Canada government data breach settlement offers up to $5,000 compensation

The Canadian government has approved an $8.7 million settlement for a class‑action lawsuit stemming from a 2020 cyber‑attack that exposed personal and financial information in Canada Revenue Agency (CRA) My Account, My Service Canada Account and other GCKey‑protected services. The settlement, authorized by the Federal Court on 5 May 2026, is administered by KPMG through an online portal.

Eligible Canadians can submit claims from 4 August 2026 until 3 February 2027. Claimants may receive up to $80 for time spent addressing unauthorized access, up to $200 for time spent dealing with fraudulent use of their information, and up to $5,000 for out‑of‑pocket expenses such as unreimbursed fraud losses, identity‑theft costs or fees related to credit freezes. Payments are subject to reduction if total approved claims exceed the fund’s balance. Legal fees of up to $2.09 million and related disbursements have been approved as part of the settlement.