Government of Canada Online Accounts Privacy Breach Settlement (Sweet v. Canada)

During the 2020 pandemic, attackers used credential stuffing, recycling passwords stolen from other sites, to break into roughly 47,000 Government of Canada online accounts and in many cases file fraudulent COVID-19 benefit claims in victims' names. The Federal Court approved an $8.76 million settlement of the resulting class action on May 5, 2026. KPMG is the claims administrator, and class members can already verify their eligibility on its portal using their name, partial SIN and email. Claim filing had not yet opened as of early August 2026: the portal was expected to launch in summer 2026 with a six-month filing window, so check the administrator's site for the confirmed deadline.

People whose personal or financial information in a Government of Canada online account, including CRA My Account and GCKey-linked services, was accessed without authorization during the credential-stuffing attacks of summer 2020, roughly June 15 to August 30. Class members should have received an eligibility notice from KPMG and can confirm status on the administrator's site.

Up to $80 for accounts that were accessed, up to $200 where the access led to fraud such as bogus CERB applications (both calculated at $20 per hour of lost time), and up to $5,000 from a special fund for documented out-of-pocket losses. Note: the claims portal had not yet opened and no filing deadline had been published as of August 3, 2026; a six-month claims window is expected once it launches..

No payment amount is ever guaranteed. Pro rata payouts shrink as more valid claims come in, and every payment waits on final court approval and any appeals.

Partial proof: the base payment does not require documents, but higher payment tiers (such as documented-loss reimbursement) do. You can usually file the simple tier with just the claim form, or attach records to claim more.