$5000 CRA Data Breach Settlement 2026: The claims portal for the CRA My Account data breach settlement officially went live on August 4, 2026, giving eligible Canadians their first real opportunity to file for compensation that could reach $5,280 combined per person. The portal, administered by KPMG at breachsettlementcanada.kpmg.ca, opened following Federal Court approval of an $8.7 million settlement in the case of Sweet v. His Majesty the King, resolving a class action tied to a series of credential-stuffing cyberattacks that hit Government of Canada online accounts throughout 2020.
If your CRA My Account, My Service Canada Account, or another federal account accessed through GCKey was compromised during 2020, you now have a defined filing window and a specific process to follow, but there are real documentation requirements and a hard deadline that could disqualify a late or incomplete claim. This guide walks through exactly how to check your eligibility, what each compensation tier requires as proof, how to actually submit your claim on the KPMG portal, and how to avoid the scam attempts already circulating around this settlement. We’ll be updating this article monthly as the claims window progresses toward its deadline.
$5000 CRA Data Breach Settlement 2026
Between June 15 and August 30, 2020, hackers launched coordinated credential-stuffing attacks against Government of Canada online services, a technique where criminals use usernames and passwords stolen from unrelated data breaches to try logging into other accounts, betting that many people reuse the same credentials across multiple websites. The attacks succeeded in accessing thousands of CRA My Account and My Service Canada Account profiles, and in some documented cases, the compromised login details were used to file fraudulent CERB applications in victims’ names during the early months of the COVID-19 pandemic. More than 47,000 Canadians had personal or financial information exposed as a result.
A class action followed, initiated by plaintiff Todd Sweet, alleging the federal government was negligent in safeguarding confidential personal information tied to these online accounts. The Federal Court certified the class action in August 2022, and after years of litigation, the case resolved in a settlement rather than a trial. On May 5, 2026, Federal Court Justice Richard Southcott approved the $8.7 million settlement, formally valued at $8,760,500.90, describing its terms as fair, reasonable, and in the best interests of the class as a whole. The Government of Canada has not admitted any wrongdoing as part of the deal, and it agreed to the settlement specifically to resolve the litigation without a lengthy trial process.
Am I Eligible? Understanding the Class Definition
You are considered a class member if your personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and December 31, 2020. This covers CRA My Account, My Service Canada Account, and any other Government of Canada online account accessed using GCKey. Certain individuals fall under an excluded persons category and are not eligible, generally those who already resolved related claims through other channels, so anyone unsure of their exact status should check their eligibility directly through the settlement portal rather than assuming based on a general description alone.
Being part of the class does not automatically guarantee a payment. The settlement structure requires you to actually file a claim and, for some tiers, provide supporting documentation, meaning eligible Canadians who take no action will not receive compensation even though they technically qualify as class members.
EITC Refund 2026: IRS Confirms Up To $4,427 for Taxpayers With One Child
How Much Can You Actually Claim? The Three Compensation Tiers
Compensation under this settlement is broken into three distinct tiers, and your total payout depends on which tiers apply to your specific situation, with a combined maximum of $5,280 per person.
The first tier is an access claim, worth up to $80, available simply for having your account accessed without authorization during the breach window, regardless of whether that access led to further harm. The second tier is a fraud claim, worth up to $200, intended to compensate for time spent addressing fraudulent use of your personal information, such as dealing with an unauthorized CERB application filed in your name. The third and largest tier is the special compensation fund, worth up to $5,000, reserved specifically for documented out-of-pocket expenses directly tied to the breach, such as unreimbursed fraud losses, identity theft recovery costs, or credit monitoring fees you paid as a result of the incident. This third tier requires actual supporting documentation, such as receipts or financial records showing the expense, since it compensates real financial loss rather than a flat statutory amount.
Step-by-Step: How to File Your CRA Breach Settlement Claim
Filing your claim involves a specific sequence of steps, and following them in order reduces the chance of a delay or rejection.
Start by visiting the official KPMG settlement portal directly at breachsettlementcanada.kpmg.ca rather than clicking a link from an email or text message, since scam attempts have already been reported using this settlement as bait. On the portal, verify your eligibility by entering your last name, the last three digits of your Social Insurance Number, and the email address linked to your Government of Canada online account. If the system confirms you as a class member, you can proceed to the claim form itself.
Next, select which compensation tiers apply to your situation. If you are only claiming the access tier, no additional documentation is generally required beyond confirming your class membership. If you are claiming the fraud tier, be prepared to briefly describe the fraudulent activity connected to your account, such as an unauthorized benefit application. If you are claiming the special compensation fund for out-of-pocket expenses, gather your supporting documents before starting the form, including receipts for credit monitoring services, records of unreimbursed financial losses, or documentation of identity theft recovery costs, since incomplete documentation is one of the most common reasons a higher-tier claim gets delayed or reduced.
Submit your completed claim through the online portal rather than by mail if possible, since KPMG has indicated online submissions are processed faster than paper claims. Keep a copy or screenshot of your submission confirmation, since this is your proof of having filed within the deadline if any question arises later. Finally, watch for any follow-up communication from KPMG requesting additional information, and respond promptly, since an unanswered request for clarification can hold up processing of an otherwise valid claim.
VA Burial Allowance 2026 Rates, Eligibility and How to Apply?
Form I-551 Confirmed Green Card Holders Enter US Without a Visa
Key Settlement Dates and Deadlines
| Date | Milestone |
|---|---|
| June 15 to August 30, 2020 | Credential-stuffing cyberattacks occurred against Government of Canada accounts |
| August 2022 | Federal Court certifies the class action |
| May 5, 2026 | Federal Court approves the $8.7 million settlement |
| August 4, 2026 | KPMG claims portal officially opens for submissions |
| February 3, 2027 | Final deadline to submit a claim |
Watch Out for Settlement Scams
Because this settlement has received wide media coverage, it has also attracted scam activity. Fraudsters are known to send unsolicited emails or text messages claiming to be from the settlement administrator and asking recipients to click a link, confirm banking details, or pay a fee to release their payment. The real KPMG settlement process does not require any upfront payment to receive compensation, and the only official portal is breachsettlementcanada.kpmg.ca. If you receive a message urging urgent action, asking for a fee, or requesting your full banking password or online banking credentials rather than basic identifying details, treat it as fraudulent and do not click any embedded links. When in doubt, navigate to the settlement website directly by typing the address yourself rather than clicking through a message.
Is the Settlement Payment Taxable?
Personal damages payments from Canadian class action settlements, including this one, are generally not considered taxable income. That said, recipients should still watch for any tax slips issued by KPMG or the settlement administrator following payment, since specific circumstances can occasionally affect how a payout is treated, and consulting a tax professional is worthwhile if you receive a larger payout under the special compensation fund tier.
What to Do If Your Claim Is Denied or Reduced
If your claim comes back denied or your special compensation fund amount is lower than you expected, review the specific documentation the settlement administrator requested and confirm you provided clear, dated proof of the expense you claimed. Vague or undated receipts are a common reason a documented-loss claim gets reduced. If you believe an error was made, the settlement portal or the case’s legal counsel of record typically provides a process for requesting reconsideration, so check the official settlement website for current instructions on disputing a determination rather than assuming the initial decision is final.
Official Resources and Verification Links
| Resource | Purpose | Link |
|---|---|---|
| KPMG official settlement portal | Check eligibility and file your claim | breachsettlementcanada.kpmg.ca |
| Federal Court decision, Sweet v. His Majesty the King | Official 2026 FC 590 approval judgment | fct-cf.gc.ca |
| Government of Canada settlement information page | Official government confirmation of the settlement | canada.ca (CRA privacy breach settlement) |
| CRA My Account login | Check and secure your own CRA account | canada.ca/en/revenue-agency/services/e-services/cra-login-services.html |
| GCKey account management | Update or secure your GCKey credentials | canada.ca/gckey |
| Report a scam | Report suspicious settlement-related messages | antifraudcentre-centreantifraude.ca |
FAQs
How much money can I get from the CRA breach settlement?
Up to $5,280 combined per person, made up of up to $80 for an access claim, up to $200 for a fraud claim, and up to $5,000 for documented out-of-pocket expenses through the special compensation fund.
When did the CRA breach settlement claims portal open?
The portal officially opened on August 4, 2026, and is administered by KPMG at breachsettlementcanada.kpmg.ca.
What is the deadline to file a CRA breach settlement claim?
February 3, 2027 is the final deadline. Claims submitted after this date will not be accepted.
Do I need documentation to file a claim?
It depends on the tier. The access claim generally does not require extensive documentation beyond confirming class membership, while the special compensation fund tier for out-of-pocket expenses requires actual receipts or records showing the financial loss.
Is this settlement legitimate, or could it be a scam?
The settlement itself is real and was approved by the Federal Court on May 5, 2026. However, scammers have used news coverage of the settlement to send fake messages. Only use the official portal at breachsettlementcanada.kpmg.ca, and never pay a fee or provide your online banking password to file a legitimate claim.
Will I owe taxes on my settlement payment?
Personal damages payments from Canadian class action settlements are generally not taxable, though you should watch for any tax slips issued by the settlement administrator and consult a tax professional if you receive a larger payout.
What accounts are covered by this settlement?
CRA My Account, My Service Canada Account, and any other Government of Canada online account accessed using GCKey, provided your information was disclosed without authorization between March 1, 2020, and December 31, 2020.
Can I still file a claim if I am not sure whether my account was affected?
Yes. The KPMG portal allows you to verify your eligibility directly by entering your last name, the last three digits of your Social Insurance Number, and the email address linked to your government account, which will confirm whether you are a recognized class member.
Conclusion
With the KPMG claims portal now open and a firm February 3, 2027 deadline in place, eligible Canadians affected by the 2020 Government of Canada account breach have a clear, defined window to file for compensation of up to $5,280, but only if they take the step of actually submitting a claim and, where applicable, gathering the documentation needed for the higher-value special compensation fund tier. The most important actions right now are verifying your eligibility directly on the official portal, gathering any receipts tied to breach-related expenses before you start the form, and staying alert to scam messages that try to exploit public awareness of this legitimate settlement.
SSI Payment Schedule August 2026: No Separate August Check, Next Payment September 1
