What to know
- Claims are now open for Canadians affected by the 2020 Government of Canada account breach.
- Eligible claimants could receive up to $5,000 for certain out-of-pocket expenses related to fraud and identity theft.
- Claims must be submitted by Feb. 3, 2027.
Heads up: if you were impacted by the 2020 data breach affecting Canadian Government online accounts, you could be owed up to $5,000.
The claims process is now open for a class-action lawsuit involving thousands of Canadians whose personal and financial information was fraudulently accessed through Government of Canada online accounts in 2020.
The lawsuit, Sweet v. His Majesty the King, alleges that inadequate safeguards allowed unauthorized third parties to access confidential information belonging to people who used Government of Canada online accounts. In some cases, the information was allegedly used to make fraudulent applications for government benefits.
The Government of Canada denies any wrongdoing.
The class-action settlement is worth $8.7 million, and was reached last December before receiving court approval in May. Eligible class members can now submit a claim online or by mail.
Who is eligible?
Class members include people whose personal or financial information in a Government of Canada online account was disclosed to an unauthorized third party from March 1-Dec. 31, 2020.
That includes:
- Canada Revenue Agency accounts
- My Service Canada accounts
- Other Government of Canada online accounts accessed using GCKey
But there is an important distinction: being a class member does not necessarily mean you will receive a payment. According to the settlement information, class members include those whose personal or financial information in a Government of Canada Online Account was disclosed to a third party without authorization between March 1 and December 31, 2020.
If you received an email from KPMG, the claims administrator, notifying you about the settlement, you are eligible to apply for a payment. People who are unsure whether they qualify can also check through the eligibility portal.
How much could you receive?
According to KPMG, members of the class action who submit valid claims are expected to receive up to $80 for time spent addressing issues related to unauthorized access, and up to $200 for time spent addressing fraudulent use of personal information.
Meanwhile, those who experienced out-of-pocket expenses related to the breach, such as unreimbursed fraud losses and identity theft costs, can receive as much as $5,000. Eligibility will be determined based on whether applicants’ information was accessed during the credential stuffing attacks that occurred between June 15 and August 30, 2020.
Those who are eligible can submit their claims online or by mail now through Feb. 3, 2027.
What happened in 2020?
Hackers targeted Government of Canada online accounts during the COVID-19 pandemic, with some attacks used to fraudulently apply for government benefits in victims’ names.
Among the information that could have been exposed were sensitive details including Social Insurance Numbers, home addresses and banking information. The attacks affected government accounts including those operated by the CRA, where thousands of accounts were compromised.
The class action alleges that inadequate safeguards allowed unauthorized third parties to access this information. The government has denied the allegations and, in a statement, said the settlement represents a compromise of disputed claims and is not an admission of wrongdoing.
How do you make a claim?
Eligible class members can submit their claim online through KPMG. Those with questions about the claims process can contact the administrator for more information.
If money remains from the settlement after eligible claims have been paid, Ottawa has agreed to donate the excess to the Privacy and Access Council of Canada to support privacy research.
