New CRA Settlement Offers Up To $5,000 In Eligible Claims
A new CRA settlement is now drawing major attention across Canada because eligible Canadians may be able to claim compensation of up to $5,000.
immigrationnewscanada.caHere’s the latest widely reported update on the CRA data breach settlement.
Direct answer
- A Federal Court settlement related to a 2020 Canada Revenue Agency data breach was approved in May 2026. The court accredited an $8.7 million (approximately) class-action settlement to resolve claims from tens of thousands of Canadians whose Government of Canada online accounts were affected, including CRA My Account users. Eligible class members may be able to claim compensation, with some reports noting potential awards or reimbursements up to several thousand dollars depending on circumstances. The settlement process is being administered by a third-party administrator (KPMG in some reports) and includes provisions for documented financial losses and other eligible harms.
Context and key details
-
What happened: A multi-organization cyberattack in 2020 affected Government of Canada online accounts, including CRA My Account, exposing personal information of many Canadians. The breach prompted a class-action lawsuit and a court-ordered settlement process. Multiple outlets reported the settlement amount and court approval around May 5–13, 2026. The aggregate settlement amount was around $8.7 million, with some outlets noting up to $5,000 potential claims for eligible individuals in certain formulations of the settlement. The reporting consistently ties the settlement to the CRA-related data breach among the Government of Canada online accounts.[1][2][4]
-
Eligibility: Class members include individuals whose personal or financial information in a Government of Canada online account was disclosed to a third party without authorization during 2020 (March 1 to December 31, 2020), including accounts used for CRA, Service Canada, and GCKey portals. Excluded persons may apply for the defined exclusions under the settlement terms. Administration and eligibility details are typically published on a dedicated settlement website maintained by the administrator.[2][4][6]
-
What may be claimed: Reports indicate individuals could seek compensation for out-of-pocket losses, identity theft-related expenses, credit monitoring, and other harms arising from the breach; some coverage references include caps or structured compensation, though exact per-person amounts may depend on documentation and verified impact. The actions are state-backed civil recovery rather than criminal penalties.[3][5][2]
-
News coverage: Multiple Canadian outlets summarized the approval and settlement terms in early to mid-May 2026, highlighting the court’s finding that the settlement is fair and in the best interests of the class. Some sources emphasize that the news follows a 2025 agreement in principle and that the formal approval occurred around May 5, 2026.[4][2][3]
Where to verify and claim
- If you held a Government of Canada online account (including CRA My Account) during 2020 and suspect data exposure, you should monitor the official settlement administrator updates for eligibility criteria, claim forms, and deadlines. Look for a dedicated settlement website or official government notices, which are typically linked in credible news coverage and court notices.[6][2]
Notes on the broader context
- The settlements reflect ongoing accountability for large-scale cyber incidents affecting government services and citizen data. Coverage often notes that while the financial settlement provides redress, cybersecurity experts stress ongoing vigilance and improvements to prevent similar credential-st stuffing and data exposure risks in the future.[1][2]
If you’d like, I can pull the latest official settlement site link and walk you through the eligibility questions and how to file a claim. I can also summarize the exact amounts available under the current version of the settlement once you confirm you want a step-by-step guide.