Here’s the latest on the CRA data breach settlement.
- The federal government has agreed to an $8.7 million class-action settlement related to the 2020 CRA data breach, which affected tens of thousands of Canadians using CRA online accounts during the pandemic. This settlement was reported in early May 2026, with final approval discussions and claim processes moving forward.[1][3][6][7]
- Eligible Canadians may be able to claim $80 for inconvenience, up to $200 for fraudulent claims, and a Special Fund that could provide additional compensation (up to several thousand dollars in some cases) depending on proof of loss or impact, with the overall fund designed to cover legal fees and administrator costs.[4][6][7]
- Final approval hearings and claim windows were scheduled around March–May 2026, with ongoing communications about eligibility checks and how to file through designated administrator portals (e.g., the KPMG-administered portal) and related official notices.[6][7][4]
Illustration (what this means for claimants):
- If you had a Government of Canada online account (including CRA My Account) and experienced fraud tied to the 2020 breach, you may be eligible for compensation. Check the administrator portal for your eligibility, and be prepared to document any losses, identity-theft impacts, or fraud occurrences linked to the breach.[7][4]
What to do next:
- If you think you’re eligible, monitor official government communications and the administrator portal for steps to verify eligibility and submit a claim. Deadlines and exact payout schedules are described in the settlement notices and court filings from spring 2026.[4][6]
Citations:
- Settlement amount and scope:.[3][1][6]
- Claim structure and eligibility details:.[7][4]
- Court approval timeline and notices:.[4][7]
Sources
Canadians who have Government of Canada online accounts, including a CRA account, could be eligible to cash in on an approved settlement.
dailyhive.comOttawa is bracing for a multi-million-dollar bill after reaching a settlement in a class action lawsuit tied to the 2020 hacking of tens of thousands of federal taxpayer accounts, the Treasury Board confirmed.
www.westernstandard.newsSweet claimed that the government “breached class members’ privacy by not properly safeguarding confidential personal and financial information” and that the “inadequate safeguards allowed bad actors to access the online accounts of Canadians” without their consent, according to a government notice . Court filings say that the CRA learned of the breach, which is called a “credential stuffing” attack, on Aug. 6, 2020, after receiving a tip from a law enforcement partner that the hacking method...
unpublished.caBreaking update on the 2026 CRA Privacy Breach Class Action settlement. Verify your eligibility, check the March 31 approval hearing details, and calculate your max payout.
cksaksens.comYou may be eligible for a fairly large settlement payout if you have accounts on Canadian government websites, including the CRA.
604now.comMark Us Preferred on GoogleWilliam HetheringtonUpdated: 0:00 The federal government has agreed to pay $8.7 million to settle a class-action lawsuit launched after tens of thousands of Canada Revenue Agency accounts were compromised in a 2020 cyberattack. The settlement stems from a data breach during the COVID-19 pandemic, when many Canadians were using CRA online accounts to access emergency benefits and tax services. Cybercriminals used stolen usernames and passwords from unrelated data...
www.theepochtimes.comGovernment of Canada Privacy Breach Class Action – Proposed Settlement
www.breachsettlementcanada.kpmg.caMay 7, 2026 The federal government will pay $8.7 million to settle a class-action lawsuit involving tens of thousands of Canadians whose sensitive information was compromised or stolen when hackers got into their accounts on government websites, including the Canada Revenue Agency (CRA) portal. Read full article
unpublished.caThe 2025 CRA data breach class action settlement allows eligible Canadians to claim compensation for financial losses, identity theft, and emotional distress.
breachspot.com