An $8.7 million settlement in the government of Canada class action lawsuit was approved

A settlement was recently approved for a class action lawsuit against the government of Canada related to Canada Revenue Agency, Service Canada and other government accounts.

Eligible Canadians could get up to $5,000 in compensation from the $8.7 million settlement.

The government of Canada privacy breach class action was filed because of cyber attacks that happened in 2020.

It's alleged that "inadequate safeguards" allowed for unauthorized third parties to access confidential personal and financial information in government of Canada online accounts, including CRA My Account, My Service Canada Account, and other accounts that use GCKey.

On May 5, 2026, a federal court approved the settlement for this Canada-wide class action.

The $8,760,500.90 settlement will be used to settle all claims related to the unauthorized disclosure of personal and/or financial information in online government of Canada accounts.

Despite the settlement, the federal government has denied any wrongdoing.

You're a class member if your personal or financial information in a government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020.

But not all class members are entitled to payments from this settlement.

Only class members who were victims of unauthorized access by third parties during the credential stuffing cyber attacks between June 15 and August 30, 2020, and whose personal information was accessed and/or used for fraudulent purposes are eligible for compensation.

You can check your compensation eligibility through the online class action site by entering your last name, the last three digits of your SIN and your email.

There are various payment levels for this settlement based on the type of claim you make.

Class members who submit valid claims are expected to receive:

• up to $80 for time spent addressing issues related to unauthorized access (Access Claim)
• up to $200 for time spent addressing fraudulent use of personal information (Fraud Claim)
• up to $5,000 for out-of-pocket expenses related to the breach, like unreimbursed fraud losses and identity theft costs (Special Compensation Fund Claim)

The claims process hasn't started yet, so you can't submit a compensation claim right now.