Almost six years after the 2020 cyber incidents affected thousands of Government of Canada online accounts, eligible Canadians can now officially apply for compensation. The claims process opened on 4 August 2026, allowing people who meet the settlement conditions to submit their applications through the court approved claims administrator.
The settlement is connected to unauthorized access involving CRA My Account, My Service Canada Account, and certain other federal online accounts that used GCKey during 2020.
While many headlines focus on the up to $5,000 amount, that figure does not apply to every claimant. The amount you may receive depends on your situation, the type of claim you submit, and whether you can provide supporting documents when required.
If you believe your government account was affected during the 2020 incidents, this guide explains who may qualify, what compensation is available, and what you should know before starting your claim.
Why Canadians Can Submit Claims Now
Although the security incidents happened in 2020, compensation could not begin until the legal process was completed.
The Federal Court approved the class action settlement on May 5, 2026. After the appeal period ended without any successful challenge, the claims process officially opened on August 4, 2026.
Claims are being managed by KPMG, which has been appointed by the court as the official claims administrator. Eligible individuals can now submit their applications online through the official settlement website.
This settlement has a total value of $8.76 million and is meant to compensate eligible class members who experienced different levels of impact after their information was accessed without authorization.
What Led to This Settlement?
During 2020, cybercriminals used stolen usernames and passwords obtained from previous data breaches on other websites to try accessing Government of Canada online accounts. This method is commonly known as a credential stuffing attack.
Because many people reuse the same password across multiple websites, attackers were able to gain access to some accounts without directly breaking government systems.
The affected online services included:
- CRA My Account
- My Service Canada Account
- Other Government of Canada accounts accessed through GCKey
In some situations, unauthorized users viewed personal or financial information. In other cases, stolen information was reportedly used to commit fraud involving government benefit programs.
These incidents eventually resulted in a national class action lawsuit, which has now reached the compensation stage.
Who May Be Eligible?
Having a CRA My Account does not automatically mean you qualify for compensation.
The settlement only covers specific individuals whose information was affected during the defined periods covered by the class action.
Generally, the settlement applies to people whose personal or financial information in an eligible Government of Canada online account was disclosed to an unauthorized third party between March 1, 2020, and December 31, 2020.
The settlement also includes two main breach situations.
1. Credential Stuffing Incidents
This category covers eligible people whose government online accounts were accessed during the credential stuffing attacks that occurred between June 26 and August 18, 2020.
2. Represent a Client (RAC) Incidents
Another group includes individuals whose information was accessed through Represent a Client (RAC) accounts between October 8 and November 25, 2020.
This second category often receives less attention, but it is especially relevant for tax representatives, accountants, and individuals whose information may have been exposed through representative access.
Quick Eligibility Overview
| Question | Information |
|---|---|
| Is every Canadian eligible? | No. Only eligible class members covered under the settlement can submit claims. |
| Which online accounts are included? | CRA My Account, My Service Canada Account, and certain GCKey based federal accounts. |
| Are RAC related incidents included? | Yes, if they fall within the settlement period. |
| Do I need to receive a notice from KPMG? | No. A notice can indicate eligibility, but it is not the only way to check. |
| Can eligibility be verified online? | Yes. The official settlement portal includes an eligibility checking tool. |
| Can someone opt out now? | No. The opt out deadline has already passed. |
How Can You Check If You Are Eligible?
Some eligible people received a letter or email from the claims administrator containing a Personal Identification Number (PIN). Receiving such a notice is usually a strong sign that you may qualify to submit a claim.
If you did not receive any communication, you should not assume that you are ineligible.
The official eligibility checker allows users to verify their status using basic identifying information linked to their government online account. If your information matches the settlement records, you can proceed with the claims process.
If your status cannot be confirmed online but you believe your account was affected during the covered period, you can contact the official claims administrator for further assistance.
What This Means for You
One thing worth remembering is that many people only focus on the advertised up to $5,000 figure. In reality, the settlement offers different types of compensation, and each has its own rules.
Before submitting a claim, spend a few minutes identifying which category matches your situation. If you experienced financial losses or paid expenses related to identity theft recovery, collect those records now instead of waiting until the last week before the deadline.
Keeping documents organized early usually makes the claims process much smoother and reduces the chance of missing important evidence later.
Another practical step is to review your CRA and other Government of Canada accounts regularly. Even if your account was not affected in 2020, using a unique password and enabling multi factor authentication can provide stronger protection against similar attacks in the future.
Understanding the Different Compensation Categories
One of the biggest misunderstandings about this settlement is that every eligible person will receive $5,000. That is not how the settlement works.
Instead, the court approved three separate compensation categories. Depending on your circumstances, you may qualify for one category or more than one. Each category has different rules, and only one of them requires proof of financial losses.
The table below gives a quick overview.
| Claim Type | Maximum Amount | Supporting Documents Needed |
|---|---|---|
| Access Claim | Up to $80 | No |
| Fraud Claim | Up to $200 | No |
| Special Compensation Fund | Up to $5,000 | Yes |
| Possible Combined Maximum | Up to $5,200 | Required only for Special Compensation Fund claims |
It is also important to remember that these are maximum limits, not guaranteed payments.
Access Claim: For Time Spent Dealing With the Breach
The Access Claim is designed for eligible people whose information was accessed without authorization but was not used to commit fraud.
Many Canadians spent time changing passwords, contacting government departments, checking their accounts, or reviewing their personal information after learning about the incident. This claim category recognizes that time.
Compensation is calculated at $20 per hour for up to four hours, meaning the maximum available payment is $80.
Examples of activities that may fall under this category include:
- Updating account security settings
- Resetting passwords
- Contacting government departments
- Reviewing account activity after the breach
- Monitoring personal information
According to the settlement terms, supporting documents are not required for this claim category.
Fraud Claim: When Your Information Was Misused
The Fraud Claim applies to eligible individuals whose personal information was not only accessed but was also used for fraudulent activity.
For example, this may include situations where someone attempted to claim government benefits using your information or redirected payments without your permission.
Compensation is calculated at $20 per hour for up to 10 hours, allowing eligible claimants to request up to $200.
During the application, claimants are generally asked to estimate the time spent dealing with the consequences of the fraud, such as communicating with:
- Government departments
- Financial institutions
- Credit reporting agencies
- Law enforcement, where applicable
Like the Access Claim, supporting documents are generally not required for this category.
Special Compensation Fund: Reimbursement for Eligible Expenses
This is the part of the settlement that has attracted the most public attention because it offers reimbursement of up to $5,000.
However, this is not a fixed payment.
The Special Compensation Fund is intended for eligible people who experienced direct financial costs connected to the breach and were not already reimbursed through another source.
Depending on individual circumstances, eligible expenses may include:
- Unreimbursed fraud related financial losses
- Identity theft recovery costs
- Professional service fees
- Certain fees linked to protecting credit records
- Other eligible out of pocket expenses connected to the breach
Unlike the first two claim categories, this one requires supporting evidence.
If documentation does not clearly show that the expense is connected to the eligible breach, reimbursement may not be approved.
A Practical Point Before You Apply
One mistake people often make is choosing a claim category before reading the eligibility requirements carefully.
If you are only claiming time spent securing your account, your application may be much simpler than someone requesting reimbursement through the Special Compensation Fund.
On the other hand, if you experienced actual financial losses, it is worth spending extra time collecting supporting records before submitting your claim. Clear documentation usually helps avoid unnecessary delays during the review process.
Can You Submit More Than One Claim?
Yes, where the settlement rules allow.
For example, an eligible person who spent time responding to the breach and also paid eligible identity theft recovery expenses may be able to submit claims under multiple categories.
However, each category has its own conditions, and reimbursement depends on meeting those requirements.
Will Everyone Receive the Maximum Amount?
Not necessarily.
Even if your claim is approved, the final amount may be lower than the published maximum.
The settlement fund has a fixed value of $8,760,500.90. Payments to individual claimants depend on factors such as:
- The number of approved claims
- The compensation categories approved
- Court approved legal fees and administration costs
- The remaining settlement funds available for distribution
If approved claims exceed the available funds, payments may be adjusted on a proportional basis according to the settlement terms.
This means two eligible claimants may receive different amounts depending on the type of claim they submit and the final distribution calculations.
Documents That May Help Strengthen Your Claim
Although not every claim requires supporting documents, keeping relevant records can make the review process easier, especially if you are applying for reimbursement through the Special Compensation Fund.
Useful records may include:
- Bank statements showing unreimbursed losses
- Credit card statements with unauthorized transactions
- Identity theft recovery invoices
- Credit bureau fee receipts
- Police reports, where applicable
- Letters from financial institutions confirming fraudulent activity
- Correspondence related to resolving the breach
You do not need every document listed above. The documents you submit should simply help demonstrate that your claimed expenses are directly connected to the eligible incident.
How to Submit Your Claim Online
If you have confirmed that you are eligible, the next step is to complete your application through the official claims portal. Online submissions are generally the easiest way to file and help keep all information in one place.
Follow these steps carefully.
Step 1: Open the Official Claims Portal
Visit the official KPMG settlement website and select the option to apply for compensation.
Always make sure you are using the official settlement website before entering any personal information.
Step 2: Sign In or Create Your Account
Use your email address to sign in or create a new account if you are using the portal for the first time.
Step 3: Enter Your Personal Details
You will be asked to provide information such as:
- Full name
- Residential address
- Phone number
- Email address
- Social Insurance Number as requested in the application
Enter all details carefully to avoid delays during the review process.
Step 4: Enter Your PIN (If You Received One)
Some eligible class members received a letter or email containing a Personal Identification Number (PIN).
If you received one, enter it during the application process. If you did not receive a PIN, you can still check your eligibility using the official settlement tools.
Step 5: Select the Appropriate Claim Type
Choose the category that matches your situation.
Depending on your eligibility, this may include:
- Access Claim
- Fraud Claim
- Special Compensation Fund
- More than one category, if applicable under the settlement terms
Step 6: Provide Required Information
For Access and Fraud Claims, you will be asked to report the time you spent dealing with the consequences of the breach.
If you are applying under the Special Compensation Fund, upload any supporting documents that show your eligible expenses.
Step 7: Choose Your Payment Method
Eligible claimants can select the available payment option offered through the claims process.
Review your information carefully before submitting the application.
Important Dates You Should Know
Keeping track of the settlement timeline can help you avoid missing an important deadline.
| Date | Event |
|---|---|
| March 1 to December 31, 2020 | Period covered under the settlement |
| June 26 to August 18, 2020 | Credential stuffing incidents |
| October 8 to November 25, 2020 | Represent a Client related incidents |
| August 25, 2022 | Class action certified by the Federal Court |
| January 15, 2026 | Eligibility checker became available |
| February 20, 2026 | Opt out deadline ended |
| May 5, 2026 | Settlement approved by the Federal Court |
| August 4, 2026 | Claims portal officially opened |
| February 3, 2027 | Final deadline to submit claims |
Waiting until the last few days is generally not recommended, especially if your claim depends on supporting documents.
What Happens After You Submit Your Claim?
After your application is submitted, the claims administrator will review it to confirm eligibility and determine whether the requested compensation meets the settlement requirements.
If additional information is needed, you may be contacted during the review process.
Approved payments will be issued using the payment method selected during the application.
The settlement documents do not provide a fixed payment date. Distribution will begin after claims have been reviewed and processed according to the court approved settlement process.
For your own records, it is a good idea to save:
- A copy of your completed application
- Confirmation emails
- Uploaded documents
- Any future communication related to your claim
Be Careful of Settlement Related Scams
Whenever a settlement involves financial compensation, scammers often try to take advantage of public interest.
If you plan to submit a claim, keep these basic safety tips in mind.
- Use only the official settlement website.
- Never share online banking passwords with anyone claiming to help you file a claim.
- No legitimate settlement requires an upfront payment before compensation is issued.
- Be cautious of emails or text messages promising guaranteed payments.
- Double check website addresses before entering personal information.
A simple way to stay safe is to access the settlement website directly instead of clicking links received through unexpected emails or social media messages.
My Practical Take
After covering Canadian government programs and settlements for several years, one pattern appears repeatedly.
Many eligible people wait until the final weeks before the deadline. By then, finding bank records, invoices, or identity theft related documents often becomes much harder.
If you believe your case involves actual financial losses, start collecting your paperwork now, even if you plan to submit the claim later. Having everything ready early can make the application process much smoother.
It is also worth reviewing your CRA and other Government of Canada account security settings. Using a unique password and enabling multi factor authentication can help reduce the risk of similar incidents in the future.
FAQ
No. The settlement only applies to eligible class members whose information was affected during the specific periods covered by the court approved agreement.
No. The $5,000 amount is the maximum reimbursement available under the Special Compensation Fund for eligible documented expenses. Many claimants may qualify for different amounts depending on their circumstances.
Yes. Depending on your situation and the settlement rules, you may qualify to submit claims under more than one compensation category.
Claims submitted after the final deadline may not be considered under the settlement. Filing before the deadline is important.
No. Access Claims and Fraud Claims generally do not require supporting documents, while claims under the Special Compensation Fund require evidence of eligible expenses.
Fact Check: This article is based on the official Government of Canada settlement information, the Federal Court approved settlement in Sweet v. His Majesty the King (File No. T-982-20), and the official KPMG claims administrator updates available after the claims portal opened on August 4, 2026.
Disclaimer: This article is provided for general informational purposes only. It is not legal, financial, or immigration advice. Readers should always verify the latest eligibility requirements, deadlines, and claim procedures through the official Government of Canada and KPMG settlement resources before taking any action.
