Canadians affected by 2020 breaches of federal online accounts can now file claims worth up to $5,280. Online or mailed claims are due by Feb. 3, 2027.
The case is Sweet v. His Majesty the King, a class action over credential-stuffing attacks. That means attackers used usernames and passwords stolen elsewhere to log into federal accounts. In some cases they filed fraudulent CERB, CESB or EI claims or diverted benefits.
Official resources:
- Read the official notice from Canada — Use this primary source to verify the official announcement.
- Read the official notice from Canada — Use this primary source to verify the official announcement.
Table of Contents
Who is eligible?
The class covers CRA My Account, Represent a Client, My Service Canada Account and other GCKey-accessed accounts. It applies where personal or financial information was disclosed without authorization from March 1 to Dec. 31, 2020, notably during attacks from June 15 to Aug. 30, 2020.
You can check eligibility with your name plus the last three digits of your Social Insurance Number, according to the Government of Canada on the Sweet v. HMK class action page. The court-appointed administrator, KPMG, opened online claims on Aug. 4, 2026.
How much can you claim?
The $5,280 maximum is combined compensation from three tiers, described by the Government of Canada in the Notice of Settlement Approval. Access claims pay up to $80 for time spent, at $20 per hour for up to four hours. Fraud claims pay up to $200 for time spent, at $20 per hour for up to 10 hours.
The third tier pays up to $5,000 for documented out-of-pocket losses directly tied to the breach. Add all three maximums — $80 plus $200 plus $5,000 — to reach $5,280. Most people will qualify for less, based on time spent and papers saved.
How do you file?
File online at breachsettlementcanada.kpmg.ca or mail a paper claim form to KPMG. The deadline for both methods is Feb.
3, 2027. Keep copies of hours claimed, letters from CRA or Service Canada, bank records, and receipts. Complete records speed review and reduce follow-up requests.
- Confirm your name appears on the eligibility list
- Choose the tiers that fit: access time, fraud time, documented loss
- Gather receipts or records for any $5,000-tier loss
- Submit online or by mail before the deadline
What limits the payout?
The Federal Court approved the $8,760,500.90 settlement on May 5, 2026, as stated by the Government of Canada in the Treasury Board Secretariat settlement statement. It is a compromise with no admission of wrongdoing by Canada.
The court found it fair, reasonable and in class members' best interests. Payments may be reduced pro-rata if valid claims exceed the compensation pool of about $6 million, according to reporting by Money.ca on CRA breach settlement eligibility. Any unclaimed remainder goes to the Privacy and Access Council of Canada for privacy research, not back to government.
You Might Also Like
- North Dakota and Federal Government Settle Pipeline Protest Policing Lawsuit
- Data Breach at Nebraska Orthopaedic Center Triggers Class Action Suit
- Vermont Receives $92.7 Million Meta Settlement on Data Privacy