New CRA Data Breach Settlement 2026: The claims portal for Canada’s CRA data breach settlement officially opened on August 4, 2026, meaning thousands of Canadians whose government accounts were compromised in the 2020 credential-stuffing attacks can now submit compensation claims for the first time. The Federal Court approved the $8.7 million settlement on May 5, 2026, in the case Sweet v. His Majesty the King, and the mandatory 60-day appeal window closed without any challenges being filed, clearing the way for the claims process to formally begin this month. We’ll be updating this article monthly as claim volumes, processing timelines, and any settlement updates are released.
The settlement resolves claims tied to unauthorized access of Government of Canada online accounts, including CRA My Account, My Service Canada Account, and other GCKey-linked accounts, during a defined window between June 15 and August 30, 2020. While the Government of Canada has not admitted any liability or wrongdoing as part of the agreement, eligible Canadians can now visit the official KPMG claims portal to check their status and file, with a firm deadline of February 3, 2027 to submit. Claims filed after that date may not be eligible for compensation, making the coming months the critical window for anyone affected to act.
What Changed: Claims Portal Now Open
The most significant update since the settlement’s approval is that the claims process has moved from waiting to active. The Government of Canada updated its official settlement page on August 4, 2026, confirming that eligible class members can now submit claims directly through breachsettlementcanada.kpmg.ca, the dedicated portal run by claims administrator KPMG. Before this date, Canadians could only check their eligibility status using a checker tool that had been live on the KPMG site since January 15, 2026, but could not yet file an actual claim.
This timeline follows a defined legal process. The settlement received court approval at a hearing held March 31, 2026, with Justice Richard Southcott formally approving the agreement on May 5, 2026, describing its terms as fair, reasonable, and in the best interests of the class as a whole. Under the settlement’s rules, the claims portal could only open once the 60-day period for any appeal of that approval had passed without challenge, which brought the opening date to early August 2026.
CRA Data Breach Settlement Key Highlights
| Detail | Information |
|---|---|
| Total settlement fund | 8.7 million dollars |
| Court case name | Sweet v. His Majesty the King, Federal Court File No. T-982-20 |
| Settlement approval date | May 5, 2026 |
| Appeal window closed | Early August 2026, without challenge |
| Claims portal opened | August 4, 2026 |
| Claims deadline | February 3, 2027 |
| Opt-out deadline (already passed) | February 20, 2026 |
| Covered incident window | June 15 to August 30, 2020 |
| Claims administrator | KPMG |
| Official claims portal | breachsettlementcanada.kpmg.ca |
| Claims administrator phone | 1-833-724-6160 |
| Claims administrator email | breachsettlementcanada@kpmg.ca |
| Class counsel | Rice Parsons Leoni & Elliott LLP, formerly Rice Harbut Elliott LLP |
| Maximum special compensation | Up to 5,000 dollars for documented losses |
Social Security $200 Monthly Increase 2027: Which Seniors Qualify for the Biggest Raise?
Alberta AAIP Eligibility Assessment Tool: Check Your Immigration Chances Online
Understanding the Three Compensation Categories
The widely reported figure of up to 5,000 dollars has drawn most of the attention, but it applies to only one of three distinct compensation categories built into the settlement, and understanding which one applies to a given situation matters more than the headline number.
The first category compensates class members whose personal information was accessed without authorization but not used for fraudulent purposes. This covers the time and inconvenience of communicating with government officials, law enforcement, or credit agencies after learning of the breach, calculated at 20 dollars per hour for up to four hours, for a maximum of 80 dollars under this category.
A second, higher tier applies to class members who experienced a greater degree of impact connected to the unauthorized access, generally in the range of 200 dollars, reflecting a more significant disruption than the base access category but falling short of documented financial loss.
The third and highest category, the Special Compensation Fund, offers up to 5,000 dollars but is reserved specifically for class members who can document actual out-of-pocket financial losses connected to the breach that were not otherwise reimbursed, such as costs tied to identity theft, fraudulent charges, or credit monitoring services purchased in response to the incident. This category requires supporting documentation such as receipts, bank letters, or records of professional fees, and payment amounts depend on the strength of that documentation along with the settlement’s distribution rules.
Who Qualifies as a Class Member
Eligibility centers on whether a person’s Government of Canada online account, including CRA My Account, My Service Canada Account, or other accounts linked through the GCKey login service, was accessed without authorization during the covered period of June 15 to August 30, 2020, as part of the credential-stuffing attacks. These attacks did not involve government systems being directly hacked; instead, attackers used usernames and passwords stolen from unrelated, non-government data breaches to log into government accounts where individuals had reused the same credentials.
Anyone who received a direct notification email from KPMG is confirmed as part of the class. For anyone unsure of their status, the fastest way to confirm eligibility is through the checker tool on the official KPMG portal, which verifies status using a last name, the last three digits of a Social Insurance Number, and an email address. Individuals who contacted the law firm Murphy Battista LLP about this same class action before June 24, 2021 are also considered class members under the settlement’s terms, even if they otherwise fall under a separate excluded persons definition.
Simply holding a CRA My Account does not automatically qualify someone for compensation. Only accounts confirmed as accessed without authorization during the defined incident window fall within the settlement, and the administrator determines that status using the court-approved eligibility criteria.
How to File a Claim Step by Step
Canadians who believe they qualify should start by visiting breachsettlementcanada.kpmg.ca and using the eligibility checker to confirm their status before doing anything else. Once eligibility is confirmed, the same portal allows claims to be submitted online directly, covering all three compensation categories described above.
Before filing, it is worth checking the email address associated with a government online account for any prior notice from KPMG, since some of these messages have been filtered into spam folders and gone unnoticed. Anyone pursuing a claim under the Special Compensation Fund for documented losses should gather supporting evidence in advance, including receipts for credit monitoring services, professional fees related to identity restoration, bank letters, or records of fraud-related charges, since claims in this category require this documentation to be assessed. Claims can also be filed by mail, or class members can contact the administrator directly by phone or email if they believe they qualify but have not received prior notice.
All claims must be submitted no later than February 3, 2027. The settlement agreement is explicit that claims submitted after this date may not be eligible for any compensation, regardless of the category being claimed under.
What Happens After You File
Once a claim is submitted, KPMG reviews it against the eligibility criteria approved by the court and, where required, verifies any supporting documentation submitted for higher-value claims. Because every claim is reviewed individually rather than processed in bulk, payment timelines can vary considerably depending on overall claim volume and the complexity of an individual submission. Based on typical timelines for Canadian class action settlements of this scale, payments are generally expected to follow several months after the claims window closes, though the settlement administrator has not published a fixed payment date.
Any funds from the 8.7 million dollar settlement that go unclaimed after the process concludes will not simply be returned; the agreement directs unclaimed funds toward supporting privacy research, including through organizations such as the Privacy and Access Council of Canada.
450,000 Borrowers Student Debt Erased: How to Check If You Qualify?
IRS Releases New Details on the Saver’s Match Program: Up to $1,000 for Your Retirement Account
$2000 Stimulus Payment 2026 Fact-Check: Is It Really Coming?
Watch Out for Settlement Scams
The public attention this settlement has received has also attracted fraud. Scam text messages and emails falsely claiming recipients are eligible for a CRA data breach payout have circulated since news of the settlement spread, and these communications have no connection to the actual legal process. Canadians should only interact with the official portal at breachsettlementcanada.kpmg.ca, the listed KPMG phone and email contacts, or direct notices from the Government of Canada’s own settlement page, and should treat unsolicited texts or emails asking for personal or banking information in connection with this settlement as fraudulent.
Tax Treatment of Settlement Payments
Class members considering a claim have also asked whether any resulting payment counts as taxable income. Generally, compensation tied to personal damages and inconvenience under this settlement is not treated as taxable income, though individuals should watch for any tax slips issued in connection with a payment and consult a tax professional for guidance specific to their situation, since treatment can vary depending on the compensation category and a person’s individual circumstances.
Official Resources and Useful Links
| Resource | Purpose | Official Link |
|---|---|---|
| KPMG Claims Portal | Check eligibility and file a claim | breachsettlementcanada.kpmg.ca |
| Government of Canada Settlement Notice | Official case background and settlement terms | canada.ca settlement notice page for Sweet v. His Majesty the King |
| Claims Administrator Phone | Speak directly with KPMG about your claim | 1-833-724-6160 |
| Claims Administrator Email | Written inquiries about eligibility or filing | breachsettlementcanada@kpmg.ca |
| Claims Administrator Fax | Alternative submission method | 514-840-2390 |
| CRA My Account | Check your own CRA account security and activity | canada.ca/en/revenue-agency/services/e-services/cra-login-services.html |
FAQs
Is the CRA data breach settlement claims portal open right now?
Yes. The claims portal opened on August 4, 2026, and eligible Canadians can submit claims through breachsettlementcanada.kpmg.ca.
What is the deadline to file a claim?
Claims must be submitted no later than February 3, 2027. Claims submitted after this date may not be eligible for compensation.
Will everyone who qualifies receive up to 5,000 dollars?
No. The 5,000 dollar maximum applies only to the Special Compensation Fund category for documented financial losses. Other categories offer smaller amounts, generally up to 80 dollars or around 200 dollars, depending on how a class member was affected.
How do I check if I qualify for the settlement?
Visit breachsettlementcanada.kpmg.ca and use the eligibility checker, which confirms status using your last name, the last three digits of your Social Insurance Number, and your email address.
Did the Government of Canada admit fault in this settlement?
No. The settlement is a compromise of disputed claims and does not include any admission of liability or wrongdoing by the Government of Canada
Is a text or email claiming I’m owed a CRA settlement payout legitimate?
Not necessarily, and often not. Scam messages referencing this settlement have circulated widely. Only trust communications through the official KPMG portal, listed phone and email contacts, or the Government of Canada’s own settlement notice.
Will I owe tax on any settlement payment I receive?
Generally, compensation for personal damages and inconvenience under this settlement is not treated as taxable income, though affected individuals should watch for any tax slips and consult a tax professional for their specific situation.
People Also Ask
How much money can I get from the CRA data breach settlement? Compensation depends on the category that applies to you, ranging from up to 80 dollars for time and inconvenience, to around 200 dollars for greater impact, up to a maximum of 5,000 dollars for documented financial losses under the Special Compensation Fund.
When did the CRA settlement claims process open? The claims portal opened on August 4, 2026, following the Federal Court’s approval of the settlement on May 5, 2026, and the close of the 60-day appeal window without challenge.
Who is eligible for the CRA privacy breach settlement? Anyone whose Government of Canada online account, including CRA My Account or My Service Canada Account, was accessed without authorization during the credential-stuffing attacks between June 15 and August 30, 2020, is generally considered a class member.
How do I file a claim for the CRA data breach settlement? Claims are filed through the official KPMG portal at breachsettlementcanada.kpmg.ca, where eligible class members can check their status and submit supporting documentation for higher-value claims before the February 3, 2027 deadline.
Conclusion
With the claims portal now open as of August 4, 2026, the CRA data breach settlement has moved from a legal milestone into an active process that affected Canadians can actually participate in, with a firm February 3, 2027 deadline to submit. While the headline figure of up to 5,000 dollars applies only to documented financial losses under the Special Compensation Fund, the settlement’s other two categories still offer meaningful compensation for anyone whose government account was caught up in the 2020 credential-stuffing attacks. The most useful step for anyone unsure of their status is checking eligibility directly through the official KPMG portal rather than relying on secondhand claims, and gathering any supporting documentation early for those pursuing the higher-value compensation category.
H-1B 60-Day Grace Period Elimination: What US Visa Workers Should Know
Service Canada Benefit Payments August 2026 Dates, Amounts and Who Qualifies
