CRA breach settlement claims have opened: How much money could you get?
Many Canadians are entitled to compensation from a 2020 CRA class action settlement. Here is what you need to know.
Advertisement
Many Canadians are entitled to compensation from a 2020 CRA class action settlement. Here is what you need to know.
On August 4, the Canada Revenue Agency (CRA) finally opened the claims period for its multi-million-dollar class-action settlement.
A 2020 data breach affecting CRA and Service Canada online accounts had resulted in a major class action, and a settlement of $8.76 million was reached, with payments of up to $5,000 available to some claimants.
Most Canadians will likely be looking at compensation of up to $80 or $200, with the larger payouts reserved for those who can document out-of-pocket losses related to fraud or identity theft.
The hack was the result of a credential-stuffing attack. This type of breach occurs when cybercriminals use usernames and passwords from other data breaches. It is a good reason to beware the risk of reusing passwords.
According to the Notice of Settlement Approval:
“All persons whose personal or financial information in their Government of Canada Online Account* was disclosed to a third party without authorization between March 1, 2020 and December 31, 2020.
* “Government of Canada Online Account” means:
If you are not sure whether you received correspondence from the government on your data being breached six years ago, you can check the eligibility page from KPMG.
You will be asked to provide your last name, the last three digits of your social insurance number, and your email address.
Not all class members are entitled to compensation, so checking your eligibility before applying can save time and help you understand which compensation category may apply to you.
There are three different levels of compensation that depend on the impact resulting from the breach:
1. Access claims for those whose information was accessed are capped at $80.
2. Fraud claims for those whose identity information was used are up to $200.
3. A special compensation claim of up to $5,000 is available for those who can document their out-of-pocket expenses.
Most claimants will fit into the $80 or $200 categories, and even those amounts could be reduced depending on how many eligible claims are submitted.
It is also important to note that the $8.76 million headline settlement is not all going to claimants. The settlement amount includes legal fees, taxes, administration costs, disbursements, and other expenses that will reduce the funds available for applicants.
So, consider the $80 and $200 amounts as maximums, not guarantees.
You can apply online via KPMG’s page dedicated to the CRA settlement.
You can also email the Claims Administrator at [email protected].
You can contact KPMG by mail at:
KPMG
600, de Maisonneuve Blvd.
West Suite 1500, Tour KPMG
Montréal, Québec
H3A 0A3
Attention: Canada Privacy Breach Class Action Administrator
Remember that the claim submission period, which began on August 4, ends on February 3, 2027. Apply as soon as possible.
Do not expect an immediate payment after submitting your claim. Final payments will depend on the number of claims submitted and the costs deducted from the settlement fund. Claimants will need to wait until after the claims period closes before their compensation can be finalized.
For those just learning about the compensation for the class-action suit, this may come as a welcome surprise. However, the unwelcome surprise of a breach and how to avoid one should be the bigger takeaway.
Using a unique password for each online account can reduce the risk of credential-stuffing attacks. Multi-factor authentication, monitoring CRA and online banking accounts, and enhancing your cybersecurity knowledge are crucial as cybercriminals continue to look for ways to get their hands on your data and money.
Share this article Share on Facebook Share on Twitter Share on Linkedin Share on Reddit Share on Email