Claims open in $8.7-million CRA data-breach settlement

The claims period has opened for Canadians eligible under an $8.7-million class-action settlement over unauthorized access to Government of Canada online accounts, including CRA My Account.

The Federal Court approved the settlement on May 5. It resolves disputed claims and does not amount to an admission of wrongdoing. The lawsuit followed credential-stuffing attacks on GCKey and CRA accounts in August 2020, which allegedly exposed information including social insurance numbers, addresses and banking details.

Eligible class members include people whose personal or financial information was accessed or shared without authorization between June 15 and Aug. 30, 2020. The settlement also includes people who contacted Murphy Battista LLP about the action before June 24, 2021, though not every class member will qualify for payment. People who received a notice from claims administrator KPMG may also be eligible.

A claim for unauthorized access without fraudulent use can cover time spent dealing with the breach at $20 an hour for up to four hours, to a maximum of $80. Where information was used fraudulently, including for benefit applications or redirected payments, the time claim can reach $200 at $20 an hour for up to 10 hours.

A separate fund may reimburse documented out-of-pocket losses, identity-theft-related fees, fraud losses or credit-freeze charges, up to $5,000. Payments may be reduced depending on the number of claims.

People can verify eligibility and file online through the settlement website using their surname, the final three digits of their SIN and an email address. Claims must be submitted by Feb. 3, 2027.