Government of Canada Account Breach Settlement — and Most Are Worth $80

If you signed in to a Canada Revenue Agency account, a My Service Canada Account, or anything else that uses a GCKey back in 2020, there is a claim open right now with your name on it. The claims process opened on August 4, 2026. It closes on February 3, 2027.

It is not a lottery ticket. For most people the claim is worth $80, and it is capped there. The larger figure you may have seen quoted — $5,000 — requires documented, out-of-pocket losses you can prove, and even then the amount can be cut back depending on how many people file.

Here is who is actually covered, what each tier pays, and where to file it for free.

What actually happened in 2020

This is the case known as Sweet v. His Majesty the King, Federal Court file T-982-20. The Federal Court approved the settlement on May 5, 2026, finding it fair, reasonable and in the best interests of class members.

The underlying event was not a break-in at the CRA. It was credential stuffing. Attackers take username and password pairs stolen from unrelated websites — a shopping site, a forum, an old email provider — and feed them into a government login page in bulk. Most fail. A small fraction work, because people reuse passwords. Nothing at the government end has to be broken for it to succeed.

That is why GCKey mattered so much. It is one credential that opens dozens of federal services. A password recycled from a hobby website could hand someone your tax filings, your employment insurance file and your CPP record in a single sign-in.

The credential stuffing window: June 26 to August 18, 2020.

The Represent a Client breach window: October 8 to November 25, 2020.

We first wrote about this case in the CRA data breach settlement post, back when there was a settlement but no claim form. The claim form now exists. That is the new development, and it is the only reason this post is worth your time.

Who is in the class

The class definition: all persons whose personal or financial information in their Government of Canada Online Account was disclosed to a third party without authorization between March 1, 2020 and December 31, 2020.

The accounts that count: CRA My Account, CRA Represent a Client, My Service Canada Account, and other federal accounts accessed using a GCKey.

The opt-out deadline has passed. It was February 20, 2026. If you did nothing, you are in the class. There is nothing left to opt into — only a claim left to file.

The practical difficulty is memory. Six years on, most people do not remember whether their account was one of the affected ones. If your account was locked in the autumn of 2020, if you were forced through an unexpected password reset, if a benefit application was filed in your name that you did not make, or if the CRA wrote to you about suspicious activity on your file, those are the signals worth chasing down.

The three tiers, and what they really pay

Access claim — up to $80

Compensation for time spent dealing with unauthorized access to your account, at $20 per hour for up to four hours. No receipts, no documentation of expenses. This is the tier most class members will fall into.

Fraud claim — up to $200

For class members who dealt with fraud arising from the breach, at the same $20 per hour, for up to ten hours. Again, this tier compensates your time rather than your losses.

Special Compensation Fund — up to $5,000

Reimbursement for eligible out-of-pocket expenses. This is the number the aggregator sites put in their headlines, and it is the one that needs proof. Bank records, credit monitoring invoices, correspondence — the paper trail is the claim.

Every one of those figures is a ceiling, not a promise. The official notice is explicit: payment amounts may be reduced depending on the number of approved claims.

How much will you actually get?

Nobody knows yet, and be sceptical of any site that gives you a firm per-person number.

The mechanism is simple enough. A fixed pot is divided among approved claims. If more people file than the fund can pay at the posted maximums, everyone’s cheque shrinks. Whether $80 stays $80 depends entirely on how many valid claims arrive before February 3.

One more thing worth saying plainly: the Government of Canada’s own notice pages do not publish a total settlement value. News coverage has put it at roughly $8.7 million. Treat that as reported, not confirmed, and do not do arithmetic on it.

This is the same posture we took on the Silk and Great Value recall settlement, where the administrator states outright that the value of individual compensation cannot be determined until all claims have been adjudicated. Honest administrators say that. Aggregators fill the gap with invented numbers.

The February deadline is comfortable compared with what else is on the calendar. If you are working through several claims at once, the two October dates are the ones that will bite first — we set them out in the October deadlines roundup. File those, then come back to this one.

Where to file

Administrator: KPMG, at breachsettlementcanada.kpmg.ca, by phone at 1-833-724-6160, or by email at breachsettlementcanada@kpmg.ca.

Class counsel: Rice Parsons Leoni & Elliott LLP, reachable at classactions@rplelaw.com.

Deadline: February 3, 2027.

The Government of Canada also maintains a plain-language page on the case at canada.ca. Those two sites are the only sources worth trusting on this. Everything else, including this post, is commentary.

What to do this week

Work out whether 2020 was your year. Search your email for messages from the CRA or Service Canada dated between June and December 2020 — lockout notices, forced password resets, security alerts. Those are the evidence that you were affected, and they are sitting in your archive.

Pull the paperwork before you start the form. If you are claiming out-of-pocket expenses, the receipts decide it. Assemble them first; a half-finished claim is easy to abandon.

Do not pay anyone to file for you. The claim is free. Class counsel fees come out of the settlement, not out of your pocket. Any service charging an upfront fee to “process your government settlement claim” is selling you a form you can fill in yourself in fifteen minutes.

Assume every message about this settlement is a phishing attempt until you prove otherwise. Settlement news is a gift to fraudsters, because it makes an unexpected message about money seem plausible. Administrators do not phone you to ask for your banking details, and they do not text. Neither does the CRA. Go to the official site by typing the address yourself rather than tapping a link — the same rule we set out for the Capital One data breach settlement, and it applies to every benefit change too.

Do not leave it until January. Five months sounds generous. It is also long enough to forget entirely, and the administrator has no obligation to remind you.

---

More open settlements

• Two CIBC Mutual Fund Settlements Are Open at Once — Which One Applies to You
• $7.5M Silk and Great Value Recall Settlement: Who Can Actually Claim
• Two CAF Class Actions, One Already Closed
• Canada’s $32.5 Billion Tobacco Settlement and the 2027 Claim Window

---

Figures and dates in this article are as of September 10, 2026. This is general information, not legal or financial advice. Settlement terms, deadlines and eligibility rules can change, and payment amounts may be reduced depending on the number of approved claims. Confirm everything on the official settlement website at breachsettlementcanada.kpmg.ca, with class counsel, or in your CRA My Account before you rely on it.