$5,000 up for grabs in CRA hacking settlement — here’s who qualifies | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

Some Canadians who logged into their Canada Revenue Agency (CRA) account in the summer of 2020 found someone had beaten them to it — with passwords changed, direct deposit details switched and unfamiliar benefit claims filed in their name. “No red flags went off at the CRA,” exclaimed one frustrated user on discussion forum Redflagdeals.com, after discovering fraudulent Canada Emergency Response Benefit (CERB) claims had gone through their hacked account.

Now, six years after this CRA data hack, there’s a price tag attached to the collective frustration and anger experienced by Canadian taxpayers. Eligible Canadians have until Feb. 3, 2027, to apply for a piece of the $8.7-million class-action settlement.

Don’t Miss

What triggered the class-action lawsuit against the CRA?

During 2020, hackers used stolen or guessed login credentials to break into Government of Canada online accounts, including the CRA My Account and My Service Canada Account portals; it was a process known as a credential stuffing attack.

Once inside, some attackers changed direct deposit information and applied for pandemic benefits — CERB or the Canada Emergency Student Benefit — using victims’ own identities.

Tens of thousands of Canadians had personal information exposed, from social insurance numbers to banking details. As a result, a class action lawsuit, Sweet v. His Majesty the King, was certified in 2022; a settlement was reached last December, and the class action won Federal Court approval in May 2026.

Who actually qualifies for the CRA data hack payout?

Not everyone whose account was touched will see a cheque.

Technically, anyone whose personal or financial information in a CRA, My Service Canada or other GCKey-linked account was disclosed without authorization between March 1 and Dec. 31, 2020, qualifies as a member of the class action lawsuit. But payment is limited to accounts breached within a specific period of time. According to court records, the breach period is between June 26 and Aug. 18, 2020. However, claims administrator KPMG lists a different period of time for eligibility — between June 15 and August 30, 2020.

There is another breach period: Anyone whose information was accessed through a Represent a Client account between Oct. 8 and Nov. 25, 2020, also qualifies for a portion of the settlement.

Money.ca reached out to KPMG for a comment; at the time of publication, no response was received.

Any Canadian who was impacted by the CRA data breach can check their eligibility through KPMG’s website. Just enter your last name and first three digits of your social insurance number.

Read more: 3 essential money moves to make once you’ve saved $50,000

How much money is on the table

Compensation falls into three categories, and claimants can apply to more than one category.

• Category 1: Access claims — up to $80 for time spent dealing with unauthorized access, at $20 an hour for up to four hours

• Category 2: Fraud claims — up to $200 for time spent addressing fraudulent use of personal information, at $20 an hour for up to 10 hours

• Category 3: Special compensation — up to $5,000 to reimburse out-of-pocket costs tied to the breach, including unreimbursed fraud losses, identity-theft fees or credit-freeze charges

Payouts could shrink if approved claims add up to more than the $8.7-million fund can cover. Any money left over will go to the Privacy and Access Council of Canada to fund privacy research.

What to do now

• Check eligibility at breachsettlementcanada.kpmg.ca using your last name and the last three digits of your SIN

• Gather documentation of related costs — credit monitoring fees, fraud-related charges, professional fees — before applying

• File a claim online or by mail no later than Feb. 3, 2027

• Remember the settlement is a compromise, not an admission — the Government of Canada has denied wrongdoing

For Canadians who spent months arguing with banks and the CRA to prove someone else had used their identity, this settlement won’t undo the hassle. But with a five-month runway left before the claim deadline, there’s time to build a documented claim instead of guessing at eligibility.

What To Read Next

The most expensive financial mistakes are often the ones you don’t see coming. Join 19,000+ Canadians who get the money moves, risks and opportunities shaping their finances — delivered free each week. Subscribe now.

This article originally appeared on Money.ca under the title: $5,000 up for grabs in CRA hacking settlement — here’s who qualifies

This article provides information only and should not be construed as advice. It is provided without warranty of any kind.