Thousands of Canadians are owed money from a CRA data breach and the claim deadline is coming

Back in 2020, a wave of cyberattacks hit several Government of Canada platforms — including CRA My Account and My Service Canada Account — exposing the personal and financial information of over 47,000 Canadians. In many cases, stolen credentials were used to file fraudulent CERB applications in victims' names.

A class action lawsuit followed, and earlier this year, a federal court approved an $8.7 million, settlement to compensate those affected.

Now, the claims portal is getting closer to opening — and eligible Canadians will have a six-month window to file once it does.

Who qualifies?

You may be eligible if your CRA My Account or My Service Canada Account was compromised during the attacks, which took place between June 15 and August 30, 2020. If KPMG sent you an email about the settlement, you're in.

You can also check your eligibility directly at breachsettlementcanada.kpmg.ca using your last name, the last three digits of your SIN and your email address.

When can you file?

The portal hasn't opened yet, but based on the terms of the judgment, it's expected to go live sometime this summer. The filing period opens 60 days after the appeal deadline on the approval judgment passes without a challenge. Once open, eligible Canadians will have six months to submit their claim through breachsettlementcanada.kpmg.ca or by phone at 1-833-724-6160.

How much can you claim?

Compensation is broken into three categories:

• Up to $80 for time spent dealing with unauthorized access to your account
• Up to $200 for time spent addressing fraudulent use of your personal information, such as a CERB application filed in your name without your knowledge
• Up to $5,000 for out-of-pocket expenses directly tied to the breach — things like credit monitoring fees, professional fees related to identity theft, or unreimbursed financial losses

For that last category, documentation will be required, such as receipts, bank statements or invoices showing the costs are directly linked to the breach.