The Government of Canada settled a nationwide class action over unauthorized disclosures from federal online accounts, but the precise amount is CAD $8,760,500.90—not simply $8 million. The Federal Court approved the Sweet v.
His Majesty the King settlement on May 5, 2026, according to the Treasury Board of Canada Secretariat. The case concerns personal or financial information in CRA accounts, My Service Canada Accounts, and other accounts accessed through GCKey. The incidents involved credential stuffing, which means attackers reused credentials obtained from earlier breaches elsewhere rather than compromising GCKey itself, according to the Treasury Board's 2020 statement.
Table of Contents
- Who is covered—and who can receive money?
- How much can claimants receive?
- What does the settlement establish?
- What should potential claimants do?
Who is covered—and who can receive money?
The settlement class covers people whose information was disclosed without authorization between March 1 and December 31, 2020. However, class membership alone does not guarantee compensation.
The Government of Canada settlement notice identifies two narrower payment groups: This distinction matters because the overall class period is longer than the compensation windows. A disclosure during another part of 2020 may place someone in the class without making that person eligible for payment.
- Specified unauthorized-access victims affected from June 26 through August 18, 2020.
- People whose information was accessed through a Represent-a-Client account from October 8 through November 25, 2020.
How much can claimants receive?
Eligible claimants may seek up to CAD $80 for time and inconvenience caused by the access. The limit rises to CAD $200 when the information was used fraudulently, while eligible out-of-pocket losses may qualify for as much as CAD $5,000. These figures are maximums, not guaranteed payments.
Awards may be reduced if the settlement receives a large number of approved claims. The full CAD $8,760,500.90 is also not reserved for payments to affected account holders. The Federal Court's reasons for approval say the all-inclusive amount covers compensation, taxes, legal fees, honoraria, administration costs, and disbursements.
What does the settlement establish?
The agreement resolves disputed claims without an admission of liability or wrongdoing by the government of Canada. Court approval therefore confirms the settlement, but it is not a ruling that the government committed the alleged misconduct.
The CRA reported suspicious activity involving about 48,500 of more than 14 million user accounts. It locked the affected accounts, contacted account holders, and offered safeguards. That figure does not establish that all 48,500 people qualify for compensation or suffered fraudulent losses.
What should potential claimants do?
Start with the account involved and the date of the unauthorized access or disclosure. Then compare those facts with the narrower payment windows before estimating a possible award.
Do not rely on the broad March-to-December class period as proof of payment eligibility. The payment category and applicable access dates are the critical checks.
- Identify whether the incident involved a CRA account, My Service Canada Account, another GCKey-accessed account, or Represent-a-Client.
- Determine whether the access falls within one of the two payment periods.
- Separate time and inconvenience, fraudulent use, and out-of-pocket losses.
- Keep notices, receipts, transaction records, and other materials that may support the claim.
- Submit the claim by February 3, 2027.
You Might Also Like
- Lee University $1.75 Million Data Breach Settlement: Claim Procedure Guide
- Wisconsin secures $275,000 payment from 23andMe data security breach class action settlement
- Featured Class Action Cases August 2026 Update: What Changed, Why It Matters, and What to Watch Next