CRA My Account Breach Claims 2026: Thousands of Canadians affected by the 2020 CRA My Account data breach are now waiting on one final step before they can file for money. The CRA data breach settlement compensation 2026 was formally approved by the Federal Court on May 5, 2026, in the case Sweet v. His Majesty the King, resolving a class action tied to credential-stuffing attacks that hit CRA My Account, My Service Canada Account, and other GCKey-linked government services between June 15 and August 30, 2020. Eligible class members can eventually claim up to $5,280 in compensation, split across three separate categories covering account access issues, identity fraud, and documented out-of-pocket losses. As of late July 2026, the KPMG-administered claims portal at breachsettlementcanada.kpmg.ca has still not opened, since it is tied to a 60-day appeal window following the court’s approval, but eligible Canadians can already confirm their status and start gathering documentation. We’ll be updating this article monthly as the portal launch date and filing details are confirmed.
This article walks through exactly who qualifies for the CRA My Account breach claims 2026, how the $8.76 million settlement fund is structured, the three separate compensation tiers and how they add up to the $5,280 maximum, the current portal status and expected opening window, the six-month filing period once claims open, and how to avoid the settlement-related scam messages that are already circulating. Every figure below is drawn from the Federal Court’s approved settlement terms and the official KPMG administration page, so you can prepare your documentation now instead of waiting until the last minute once filing opens.
CRA My Account Breach Claims 2026 Key Highlights
| Detail | Latest Confirmed Figure |
|---|---|
| Case name | Sweet v. His Majesty the King, 2026 FC 590 |
| Court approval date | May 5, 2026 |
| Total settlement value | Approximately $8.76 million |
| Maximum combined compensation per person | Up to $5,280 |
| Access claim tier | Up to $80 |
| Fraud claim tier | Up to $200 |
| Special compensation fund (documented losses) | Up to $5,000 |
| Breach window covered | June 15 to August 30, 2020 (broader class period March to December 2020) |
| Number of Canadians affected (reported) | More than 47,000 |
| Claims administrator | KPMG |
| Claims portal | breachsettlementcanada.kpmg.ca |
| Claims phone line | 1-833-724-6160 |
| Portal status as of late July 2026 | Not yet open, expected once the 60-day appeal window closes |
| Filing window once open | 6 months |
| Legal fees approved | 33.33 percent of net settlement proceeds plus disbursements and taxes |
| Unclaimed funds destination | Privacy and Access Council of Canada |
What Happened in the 2020 CRA Data Breach
The breach behind these claims dates back to the summer of 2020, when a wave of credential-stuffing attacks hit several Government of Canada online platforms. Credential stuffing involves attackers using usernames and passwords stolen from unrelated data breaches on other websites to try logging into different accounts, exploiting the fact that many people reuse the same password across services.
Government of Canada online accounts accessed through GCKey, including CRA My Account and My Service Canada Account, were targeted in this way between June 15 and August 30, 2020, exposing personal and financial information belonging to more than 47,000 Canadians. In some documented cases, attackers used the stolen login credentials to file fraudulent Canada Emergency Response Benefit (CERB) applications, Canada Emergency Student Benefit (CESB) claims, and Employment Insurance claims in victims’ names, at a time when emergency pandemic benefit programs were processing enormous volumes of applications.
A class action was filed shortly afterward, and the Federal Court certified it in August 2022 under Sweet v. Canada, 2022 FC 1228, allowing claims for privacy breach and negligence to move forward against the federal government. Nearly four years after the original incident, the Federal Court approved the final settlement on May 5, 2026, with Justice Richard Southcott writing that its terms were fair, reasonable, and in the best interests of the class as a whole. The Government of Canada has not admitted any wrongdoing as part of the settlement.
Who Qualifies for CRA My Account Breach Claims 2026
You are considered a class member, and therefore potentially eligible, if your personal or financial information in a Government of Canada online account, including a CRA My Account, a My Service Canada Account, or any other account accessed through GCKey, was disclosed to an unauthorized third party as part of the 2020 credential-stuffing incidents. The core eligibility window covers unauthorized access between June 15 and August 30, 2020, though the broader class period referenced in the settlement spans March through December 2020.
If KPMG has already emailed you directly about the settlement, you are confirmed as part of the class and do not need to independently establish eligibility. If you have not received such a notification but believe your account was affected during this period, you can verify your own status directly through the official KPMG portal using your last name, the last three digits of your Social Insurance Number, and the email address associated with your government online account.
Certain individuals are excluded from this settlement, most notably Canadians who had already independently contacted specific legal counsel involved in related, separate litigation before June 24, 2021. This kind of exclusion is standard in class-action settlements and exists to prevent overlapping or duplicate claims across parallel lawsuits.
How Much Compensation Can You Claim
The settlement is structured around three distinct compensation categories, and eligible claimants can potentially qualify for more than one at the same time, which is how the maximum combined total reaches $5,280.
Access claims, up to $80, cover the basic fact that your account was accessed without authorization, along with the time and inconvenience spent resolving the resulting access issues, even if no further fraud occurred afterward.
Fraud claims, up to $200, apply if your compromised information was actually used for fraudulent purposes, such as a fraudulent CERB, CESB, or Employment Insurance application filed in your name using your stolen credentials.
Special compensation fund claims, up to $5,000, are reserved for documented, verifiable out-of-pocket losses directly tied to the breach. This is the largest potential category but also the one requiring the most supporting evidence, such as receipts for credit monitoring services, records of financial losses that were not otherwise reimbursed, or other documented costs incurred while resolving the fallout of the breach.
Because this fund has a fixed total value of approximately $8.76 million, actual individual payouts could end up lower than the stated maximums if the total value of approved claims exceeds what remains available. Any money that goes unclaimed after the process concludes is set to go to the Privacy and Access Council of Canada to support future privacy research, rather than reverting to the federal government.
Current Status of the KPMG Claims Portal
As of late July 2026, the claims portal has not yet opened for filing, even though eligibility checking is already available. According to the settlement’s own terms, the formal filing period is set to begin 60 days after the appeal deadline on the May 5 approval judgment passes without a successful challenge. Based on that timeline, most legal and news sources tracking the case have pointed to a likely opening window in the summer of 2026, with late July or August cited as the most probable range.
Once the portal does open, eligible Canadians will have a six-month window to submit their claims, either online through breachsettlementcanada.kpmg.ca or by phone at 1-833-724-6160. Given that this is a fixed filing period rather than a rolling deadline, waiting too long after the portal opens is not advisable, particularly for anyone planning to submit a special compensation fund claim that requires gathering supporting documents.
How to Check Your Eligibility Right Now
You do not need to wait for the portal’s full launch to start confirming your status. Visit breachsettlementcanada.kpmg.ca and use the eligibility lookup tool, which asks for your last name, the last three digits of your Social Insurance Number, and the email address linked to your Government of Canada online account. This lookup tells you whether you are already recorded as a confirmed class member.
It is also worth checking your email inbox and spam or junk folder for any past correspondence from KPMG regarding this settlement, since recipients of that direct notification are automatically confirmed as eligible class members without needing to self-verify.
What to Do While You Wait for the Portal to Open
The most useful thing eligible Canadians can do right now is prepare documentation in advance, so filing is quick once the portal opens. Start by pulling together any CRA correspondence you received about unauthorized account changes back in 2020. If you experienced identity fraud, gather records of any fraudulent CERB, CESB, or Employment Insurance applications filed in your name. If you plan to pursue a special compensation fund claim, collect receipts for credit monitoring services or documentation of any unreimbursed financial losses tied to the breach.
It is also a good time to make sure your CRA My Account and My Service Canada Account are secured with strong, unique passwords, and to confirm your direct deposit banking information on file is current, since that is typically how settlement payments are issued.
Watch Out for CRA Breach Settlement Scams
Because this settlement has received significant news coverage, scam text messages and emails claiming recipients are owed a “CRA data breach payout” have already started circulating across Canada. These messages have nothing to do with the real settlement process.
KPMG and the CRA will never ask you to pay a fee, provide a credit card number, or send money in order to release settlement funds to you. The only legitimate way to check your eligibility or eventually file a claim is directly through the official portal at breachsettlementcanada.kpmg.ca or by calling the official claims line at 1-833-724-6160. If you receive an unsolicited message asking for payment or urgent personal information in connection with this settlement, delete it and do not click any included links.
Official Resources and Useful Links
| Resource | Purpose | Link |
|---|---|---|
| KPMG Settlement Portal (Eligibility Check and Filing) | Verify class member status and file a claim once open | breachsettlementcanada.kpmg.ca |
| KPMG Settlement Claims Phone Line | Check eligibility or file by phone | 1-833-724-6160 |
| CRA My Account Login | Log in to your own CRA account and review activity | canada.ca (CRA My Account sign-in) |
| My Service Canada Account Login | Log in to your My Service Canada Account | canada.ca (My Service Canada Account sign-in) |
| Federal Court Decisions Database | Read the official Sweet v. His Majesty the King, 2026 FC 590 judgment | decisions.fct-cf.gc.ca |
People Also Ask
Is the CRA data breach settlement real or a scam? It is real. The Federal Court formally approved an $8.76 million settlement on May 5, 2026, in Sweet v. His Majesty the King, and the only legitimate portal is breachsettlementcanada.kpmg.ca. Any text or email demanding payment to “release” your settlement funds is a scam.
How do I know if I am eligible for the CRA breach settlement? You may be eligible if your CRA My Account, My Service Canada Account, or another GCKey-linked account was accessed without authorization between June 15 and August 30, 2020. You can check directly on the KPMG portal using your last name, SIN digits, and account email.
When will the CRA breach settlement claims portal open? As of late July 2026, the portal has not opened. It is expected to open roughly 60 days after the appeal deadline on the May 5, 2026 approval judgment passes without challenge, putting the likely window in the summer of 2026.
How much money can I get from the CRA data breach settlement? Eligible claimants can receive up to $80 for an access claim, up to $200 for a fraud claim, and up to $5,000 for documented out-of-pocket losses, for a combined maximum of $5,280 per person.
Do I need a lawyer to file a CRA breach settlement claim? No. Claims can be filed directly by individuals through the official KPMG portal or by phone, without needing to hire separate legal representation.
FAQs
What is the CRA My Account breach claims 2026 settlement about?
It is a court-approved $8.76 million class action settlement resolving claims that Government of Canada online accounts, including CRA My Account and My Service Canada Account, were compromised in 2020 credential-stuffing cyberattacks. The Federal Court approved the settlement on May 5, 2026.
How much compensation can eligible Canadians claim?
Eligible claimants can combine up to three categories: up to $80 for an access claim, up to $200 for a fraud claim, and up to $5,000 through the special compensation fund for documented out-of-pocket losses, for a maximum combined total of $5,280.
Is the compensation from this settlement taxable?
Personal damages portions of Canadian class action settlements are generally not taxable, but recipients should watch for any tax slips issued by KPMG and consult a tax professional about their specific situation.
When can I actually file a claim?
The claims portal had not opened as of late July 2026. It is expected to open once the 60-day appeal window on the court’s approval passes without challenge, with a six-month filing period beginning once it does.
Who is excluded from this settlement?
Canadians who independently contacted certain legal counsel involved in related litigation before June 24, 2021 are excluded from this particular settlement to prevent duplicate claims across separate lawsuits.
What happens to money that is not claimed?
Any unclaimed funds from the settlement will go to the Privacy and Access Council of Canada to support future privacy-related research, rather than reverting to the federal government.
Conclusion
The CRA My Account breach claims 2026 process represents a rare instance of Canadians being able to seek direct compensation for a government data breach, with a maximum combined payout of $5,280 across three separate categories. The settlement itself is confirmed and court-approved, but the practical filing process is still on hold as of late July 2026, pending the portal’s official launch. The smartest move for anyone who believes they were affected is to check eligibility now at breachsettlementcanada.kpmg.ca, gather supporting documentation in advance, stay alert to scam messages exploiting this story, and be ready to file promptly within the six-month window once the portal goes live. This article will be updated monthly as the portal opening date and filing details are confirmed.
Also Read
State-by-State Social Security Payments 2026: Where Benefits Are Highest?
When Can I Claim My UK State Pension? UK State Pension Age Changes Explained (2026 Update)
