Canadians eligible for up to $5,000 in proposed CRA settlement

Canadians who have online accounts with the Canada Revenue Agency (CRA) and the Government of Canada are in line to benefit from a proposed class-action settlement that could potentially see them claiming up to $5,000. This settlement comes as a response to the “credential stuffing” attacks that targeted the GCKey service and CRA accounts back in August 2020.

Todd Sweet, the initiator of this class action, accused the CRA and the Government of Canada of being negligent in protecting Canadians’ confidential information. He alleged that due to inadequate security measures in online government portals, unauthorized individuals were able to access the accounts of Canadians without their consent. Furthermore, Sweet mentioned that these malicious actors even used real accounts to apply for benefits such as the Canada Emergency Response Benefit (CERB) in several instances.

The settlement agreement reached by both parties in October 2025 aims to address these concerns. The Treasury Board of Canada Secretariat acknowledged the prevalent cyber threats faced by governments worldwide, pointing out that the Canadian government has taken steps to inform individuals potentially affected by the cyberattack.

Eligibility for the proposed settlement is defined broadly. Class members include those whose personal or financial information within their Government of Canada Online Account was exposed to third parties without authorization between March 1, 2020, and Dec. 31, 2020. Not everyone among this group will necessarily receive payments, as only individuals who were victims of the “credential stuffing” attacks within the specified dates are deemed eligible.

The proposed settlement, contingent on court approval on March 31, 2026, outlines the compensation structure. Individuals who incurred time and inconvenience from communication about their data breach issues may be eligible for up to $80 under an access claim. Those who had their information used for fraudulent purposes can claim up to $200, while individuals who faced out-of-pocket expenses related to the data breach might receive reimbursement of up to $5,000.

For individuals who qualify as class members and wish to participate in the settlement, no immediate action is required. They are automatically included in the class unless they choose to opt out. Once the court gives its approval, eligible individuals will be notified about the compensation application process.

In summary, this proposed settlement seeks to address the privacy concerns raised by the “credential stuffing” attacks on the accounts of Canadians belonging to the CRA and the Government of Canada. If the court approves the settlement, eligible individuals could claim compensation for the inconveniences and losses they faced due to the compromised security of their accounts.