Canadians who had a Government of Canada online account in 2020 should pay attention this week. The claims portal for a major privacy breach settlement has just opened, and eligible claimants can now file for compensation worth up to $5,280.
The class action lawsuit originates from a series of credential-stuffing attacks that struck federal platforms between June 15 and August 30, 2020, targeting CRA My Account, My Service Canada Account, and other accounts accessed through GCKey.
Unauthorized parties accessed personal accounts and, in some cases, used the information obtained to file fraudulent Canada Emergency Relief Benefit (CERB) and Canada Emergency Student Benefit (CESB) claims under victims' names.
The Federal Court approved an $8.76 million settlement in the case, Sweet v. His Majesty the King, on May 5, 2026. It's worth noting that the Government of Canada denies any wrongdoing.
Eligibility exists on two levels. Anyone whose data was disclosed to a third party without authorization between March 1 and December 31, 2020 qualifies as a class member, though membership alone does not guarantee compensation.
Payment is limited to individuals whose information was accessed, or accessed and used fraudulently, specifically during the credential-stuffing attacks between June 15 and August 30, 2020.
Those who were contacted directly by KPMG, the claims administrator, with a personal identification number are already confirmed as eligible. Others may still qualify and can check their eligibility online using their last name, the last three digits of their Social Insurance Number, and the email address associated with their government account.
Compensation is structured across three categories:
- Access Claims: Up to $80 for time spent addressing issues related to unauthorized access.
- Fraud Claims: Up to $200 for time spent addressing fraudulent use of personal information.
- Special Compensation Fund: Up to $5,000 for out-of-pocket expenses related to the breach (e.g., unreimbursed fraud losses, identity theft costs).
The Special Compensation Fund is the only category that requires supporting documentation. Access and fraud claims require none.
The combined maximum across all three categories is $5,280, though this figure represents a ceiling rather than an expected payout for every claimant.
It's also worth noting that payouts may be reduced if the volume of approved claims exceeds the funds available.
Any unclaimed portion of the settlement will not return to the federal government; it has been allocated to the Privacy and Access Council of Canada to support future privacy research.
The claims portal opened on August 4, 2026, so eligible class members are now invited to submit compensation claims online or via mail.
To submit a claim online, select "Apply for Compensation" on KPMG's website and register an account using an email address. Applicants must provide their name, phone number, address, and Social Insurance Number, along with their personal identification number if one was issued.
Claimants must also document the number of hours spent addressing the breach, including time spent communicating with government officials, law enforcement, or credit agencies.
Payment can be issued by e-transfer, which is processed more quickly, or by cheque. Online submissions are processed faster than mailed paper claims, though a paper form remains available for those who prefer it.
All claims must be submitted by February 3, 2027.
This story was inspired by the article “The government of Canada class action lawsuit is accepting claims for the $8.7M settlement” which was originally published on Narcity Canada by Lisa Belmonte.
AI tools may have been used to support the creation or distribution of this content; however, it has been carefully edited and fact-checked by a member of MTL Blog's Editorial team. For more information on our use of AI, please visit our Editorial Standards page.
