Canadians can now submit claims for up to $5,000 in CRA data breach settlement

Canadians impacted by the Canada Revenue Agency (CRA) data breach can take action as the settlement claims period is now open.

According to an update on the Government of Canada Privacy Breach Class Action – Settlement website, the claims period officially opened on Tuesday, Aug. 4. That means that eligible Canadians can now file a claim to receive cash.

On May 5, the Federal Court approved an $8.7-million settlement in the class-action lawsuit involving an alleged privacy breach of Government of Canada online accounts, including CRA My Account. Justice Richard Southcott wrote that the terms of the settlement are “fair, reasonable, and in the best interests of the class as a whole.”

The settlement represents a compromise of disputed claims and isn’t an admission of wrongdoing.

What is the class action about?

The class action resulted from a series of “credential stuffing” attacks targeting GCKey service and CRA accounts in August 2020.

Following the cyberattacks, plaintiff Todd Sweet filed a class-action lawsuit against the CRA and the Government of Canada, alleging that they failed to adequately protect Canadians’ personal information. The lawsuit claimed that “inadequate safeguards” resulted in “bad actors” accessing Canadians’ accounts, exposing sensitive information such as social insurance numbers (SIN), addresses, and banking details.

The lawsuit also alleges that, in many cases, these bad actors used real accounts to apply for the Canada Emergency Response Benefit (CERB).

“The Government of Canada, like every other government and private sector organization in the world, faces ongoing and persistent cyber threats,” the Treasury Board of Canada Secretariat shared in a statement at the time.

Are you eligible?

You’re considered a class member if your personal or financial information in a Government of Canada online account was accessed or shared without your authorization during the affected period. The settlement also includes people who contacted Murphy Battista LLP about the CRA privacy breach class action before June 24, 2021.

However, the website notes that not all class members will be entitled to payments under the settlement agreement. It only applies to class members who were victims of unauthorized access between June 15 and Aug. 30, 2020. Those whose personal information was accessed or accessed and used for fraudulent purposes are entitled to a claim.

In addition, you’re eligible if you received a notice from claims administrator KPMG.

How much could you receive?

The amount you could receive depends on how you were affected by the data breach.

• Access claims: You could file a claim if your personal information was accessed, but not for fraudulent purposes. This category compensates you for inconvenience or time lost communicating with government officials, law enforcement, or credit agencies due to the data breach. You could get $20 per hour for a maximum of four hours, which means a maximum claim of $80.
• Fraud claims: You could file a claim if your personal information was accessed and used for fraudulent purposes, such as applications for CERB benefits, CESB benefits, and/or EI benefits under your name, or if payments for these benefits were diverted to an unauthorized bank account. You could be eligible for compensation for time lost addressing the issue at a rate of $20 per hour for a maximum of 10 hours, which means a maximum claim of $200.
• Special compensation fund: You could apply for reimbursement if you incurred out-of-pocket expenses due to the data breach. These payments would cover fraud losses or charges, professional or other fees incurred due to identity theft, and fees or penalties as a result of credit freezes. You can claim up to $5,000 for documented out-of-pocket expenses.

The website states, “Amounts may be reduced depending on the number of claims submitted.”

What should you do next?

If you meet the eligibility requirements, you can now file a claim online. Visit the settlement website and enter your last name, last three digits of your SIN, and email address to verify your eligibility.

The deadline to file a claim is Feb. 3, 2027.

With files from Isabelle Docto