$5000 CRA Data Breach Settlement 2026: How Much You Will Really Get, What Proof You Need and Whether It Is Taxable

The CRA data breach settlement payout has a headline number that does not match most people’s reality. The federal government agreed to pay $8,760,500.90 to settle a class action over the 2020 hacking of Government of Canada online accounts, and the Federal Court approved the deal on May 5, 2026. The claims portal opened on August 4, and the deadline is February 3, 2027, which is 95 days from today. Headlines say up to $5,000, but that figure applies only to documented out-of-pocket losses. Many claimants will receive $80 for time spent dealing with unauthorized access, or $200 if their information was used for fraud. The maximum a person can reach across all three tiers is $5,280, and the money can be reduced if total claims exceed the fund. We’ll be updating this article monthly as new details are released by the claims administrator.

The breach itself dates to the early months of the pandemic. Attackers used passwords leaked from unrelated websites to log in to CRA My Account, My Service Canada Account and accounts that use the GCKey login. Court records say more than 47,000 accounts were affected, and in many cases criminals used them to apply for emergency benefits such as CERB. The Government of Canada has denied wrongdoing, and the settlement is a compromise rather than a finding of fault. That means the practical questions now matter more than the legal ones. Who is really eligible, what proof is needed, how is the payout calculated, will it be taxed, and how do you avoid the scam messages that have followed the news? This guide answers each, shows the exact dates, and includes a free estimator so you can see what your claim could be worth.

CRA Data Breach Settlement Payout Key Highlights

CRA Settlement 2026 Key Dates

Who Qualifies for the CRA Data Breach Settlement Payout?

You are in the class if your personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1 and December 31, 2020. That covers CRA My Account, My Service Canada Account and other federal accounts that use GCKey. People who contacted the law firm Murphy Battista about this breach before June 24, 2021 are also included.

Being in the class does not guarantee a payment. The claims administrator pays people whose accounts were involved in the confirmed attacks, and reports differ on the exact window. Court records describe the breach period as June 26 to August 18, 2020, while the administrator has used June 15 to August 30. A separate period applies to accounts reached through the Represent a Client service in October 2020. Because of those differences, the safest step is to use the official eligibility checker, which asks for your last name, the last three digits of your Social Insurance Number and your email address. If KPMG sent you an email about the settlement, that is a strong sign you are eligible.

When Will You Get Your Social Security and SSI Payment for November? Dates by Birthday, Plus the Early SSI Deposit

How the Settlement Payout Is Calculated?

The access claim pays for your time dealing with the unauthorized access, such as changing passwords, calling the CRA or checking your records. The rate is $20 an hour for up to four hours, so the ceiling is $80. The fraud claim applies if your information was used for fraud, for example a CERB application filed in your name. It pays $20 an hour for up to ten hours, so the ceiling is $200. These two tiers are about time, and they generally rely on your statement of hours rather than receipts.

The Special Compensation Fund reimburses real money you lost or spent because of the breach, up to $5,000, and it requires proof. Reported examples include unreimbursed fraud losses, identity theft remediation fees, credit monitoring costs and credit freeze charges. Reports describe a one year window after the breach for these expenses. If total approved claims exceed the money available in the fund, payments can be reduced proportionally, so $5,000 is a ceiling and not a promise.

Several outlets report that one person can claim in more than one tier, which is how the $5,280 maximum is reached. Because the settlement documents are the final word, confirm with KPMG how your own situation is treated before you assume the full combined amount.

Three Realistic Payout Examples

Example one: an account was accessed, but nothing was stolen. You spent three hours changing credentials, checking your account and calling the CRA. Three hours at $20 is $60. That is the access claim, and there is no special fund claim because you had no losses.

Example two: someone filed a CERB application in your name. You spent eight hours on calls, forms and corrections. At $20 an hour that is $160 under the fraud tier. If you also paid $240 for credit monitoring after the incident and kept the receipts, you could claim $240 from the fund. Your total could be $400 before any reduction.

Example three: a larger loss. A criminal drained $3,200 from your bank account after getting into your information, and the bank refused to reimburse you. You also paid $90 to freeze and monitor your credit. With documents for both, the fund claim is $3,290. Add ten hours in the fraud tier ($200), and your total could be $3,490. Without paperwork, the fund portion could be denied, so the proof matters more than any other part of the claim.

What Counts as Proof for the $5,000 Fund

This tier decides most of the money, and it is where claims are most likely to fail. Gather records before you file. Useful documents include bank statements showing the fraudulent transaction and any bank response, receipts or statements for credit monitoring services, invoices for identity theft recovery services, credit bureau reports or alerts that show suspicious activity, police reports or fraud reports, CRA or Service Canada letters about fraudulent benefit applications, and notices of reassessment or corrected slips connected to the fraud.

Write a short timeline too. Note when you learned of the breach, what you did, and who you spoke to. The claims administrator may ask follow up questions, and a clear timeline helps you answer quickly. Do not exaggerate. Claims are reviewed, and a false claim can be rejected and can create legal problems.

How to Apply?

Step one: visit the official claims website run by KPMG at breachsettlementcanada.kpmg.ca and check your eligibility with your last name, the last three digits of your Social Insurance Number and your email address.

Step two: choose your claim type. Pick the access claim, the fraud claim, the special fund claim, or the combination that fits.

Step three: enter your hours and describe what you did. Keep the numbers honest and within the limits of four hours for access and ten for fraud.

Step four: upload your supporting documents for the special fund. If you prefer paper, you can download the claim form and mail it to KPMG, 600 de Maisonneuve Blvd. West, Suite 1500, Tour KPMG, Montreal, Quebec H3A 0A3, Attention: Canada Privacy Breach Class Action Administrator.

Step five: submit before February 3, 2027 and save your confirmation. For questions, the administrator lists an email address, breachsettlementcanada@kpmg.ca, and a toll free line that law firm summaries give as 1-833-724-6160. Confirm both on the official site before you use them.

You do not need a lawyer to file, and you should not pay anyone a share of an $80 or $200 claim.

Social Security Wage Base 2027 Rises to $192,300: New Max Tax, COLA and Free Calculator

Processing Time: When Will Your Claim Be Reviewed?

The administrator has not published a firm date for decisions. In class actions, claims are usually reviewed after the filing deadline closes, because the administrator must know the total before it can calculate any proportional reductions. That points to payments coming after February 3, 2027, and not in the weeks after you file. If your claim has gaps, expect a request for more information, and respond quickly, since missed replies can lead to a denial. Keep a copy of your submission, your confirmation and every email. Check the official site periodically for updates, and do not rely on social media posts about timing.

Payment Schedule: How and When Money Is Paid

There is no published payment calendar yet. Several things are known. First, the claim period runs until February 3, 2027. Second, if money is left after valid claims are paid, the government agreed to donate the excess to the Privacy and Access Council of Canada for privacy research, so unclaimed funds do not return to the government. Third, the settlement covers costs beyond claimant payments, including legal fees, taxes and administration, so the amount available to claimants is lower than $8.76 million. The lead plaintiff, Todd Sweet, was approved for an honorarium of $5,000, and two other representative plaintiffs for $1,500 each. For payment method, follow the instructions the administrator gives you when your claim is approved, and be wary of any message that asks you to pay a fee or share a password to receive money.

Is the CRA Settlement Payout Taxable?

Canadian tax law generally follows what is known as the surrogatum principle. A settlement payment takes on the tax character of what it replaces. A tax law firm summarizing the settlement says reimbursements for out-of-pocket losses are generally not income, since they restore money you lost, and that payments for time and inconvenience are commonly treated as non-taxable personal compensation. It also notes two exceptions. A payment that replaces something that would have been taxable, such as business income, can take on that character. And any interest component is generally taxable.

If the administrator issues a tax slip, the CRA receives a copy, so report what the slip shows. This is general information and not tax advice. If you are claiming a large amount or the loss touched your business, speak with an accountant before you file your return for the year you receive the money.

If a Benefit Was Claimed in Your Name: Fix the Tax Record Too

For many victims, the worst result was not the unauthorized login but the fraud that followed. Criminals used hijacked accounts to apply for CERB, CRB or EI, and the real person later received a T4A or T4E slip for money they never got. Some were assessed tax on it or told to repay it.

If that happened to you, the settlement is only part of the fix. Report the identity theft to the CRA and Service Canada, ask for the fraudulent application to be flagged, and request a corrected slip. If you were reassessed, you can file a notice of objection within the deadline stated on the notice, and you can ask for taxpayer relief from interest and penalties. The same evidence you collect for the special fund, such as letters, slips and reports, supports these steps. Time limits apply to objections, so do not wait for the settlement payment to deal with a reassessment.

Warning: Fake CRA Settlement Messages

Scammers follow news like this. Texts and emails promising a CRA data breach payout, asking you to click a link, confirm your banking details or pay a processing fee, have circulated since the settlement was announced. Reporting says KPMG and the CRA will never ask for a fee to release settlement money. The only legitimate claims website is the one run by KPMG, and you should type the address yourself instead of tapping a link in a message.

Red flags include urgent deadlines in the message, requests for your full Social Insurance Number or online banking password, a payout amount that does not match the three tiers, and payment demands by gift card or cryptocurrency. If you receive one, do not respond. Report it to the Canadian Anti-Fraud Centre and delete it. The real eligibility checker needs only the last three digits of your SIN, never the full number.

Lock Down Your Account Now

If your account was part of the breach, treat it as a target. Use a unique password you have not used anywhere else, turn on multi-factor authentication, and sign up for the CRA’s email notifications for account changes. Review your account for changes in address, direct deposit, returns you did not file or benefits you did not request. If you see something wrong, call the CRA and ask to have your account flagged. Consider placing a fraud alert with the two credit bureaus, Equifax Canada and TransUnion Canada. The credential stuffing method works because people reuse passwords, so a password manager is a practical protection.

Can You Still Sue Separately?

The opt-out deadline was February 20, 2026, and it has passed. People who did not opt out are bound by the settlement and gave up the right to sue the government separately over this same breach. Anyone who opted out can pursue their own case but cannot receive money from this settlement. The Federal Court judge acknowledged that some people may feel the compensation does not fully reflect the harm they felt, but approved the deal as fair, reasonable and in the best interests of the class.

CRA Settlement Payout Estimator

Use the estimator below to see what your claim could be worth. Enter the hours you spent on each issue and your documented losses, and the tool applies the hourly rates, the caps and the $5,000 limit. It also counts the days left until the deadline.

Official Resources and Links

$1600 Property Tax Credit 2026: Fact Check, Eligibility, Dates and How to Apply?

CRA Data Breach Settlement Payout FAQs

Conclusion

The CRA data breach settlement payout is real, but it is smaller and more specific than the headlines suggest. Most people will qualify for time based amounts of $80 or $200, and the $5,000 figure is a ceiling for documented losses that may be reduced. With 95 days left, the best plan is to check your eligibility on the official KPMG site, gather your documents, file honestly before February 3, 2027, and fix any tax problems caused by fraud at the same time. Avoid fake messages, secure your account, and confirm current details on the official pages before you act. This article is general information and not legal or tax advice.