Canada Proposes Class-Action Settlement for 2020 Credential Stuffing Attacks on Government Accounts In August 2020, the Canadian government faced credential stuffing attacks targeting the GCKey service and Canada Revenue Agency (CRA) accounts, exposing the personal and financial data of Canadians. The breach prompted a class-action lawsuit filed by Todd Sweet, who alleged that inadequate security measures allowed unauthorized access to government portals, enabling fraudsters to exploit accounts—including filing fraudulent claims for the Canada Emergency Response Benefit (CERB). A proposed settlement was reached in October 2025, with court approval pending for March 31, 2026. The government acknowledged persistent cyber threats but confirmed that affected individuals would be notified directly. ### Eligibility & Compensation Eligible class members include those whose Government of Canada Online Accounts (CRA, My Service Canada, or GCKey-linked accounts) were accessed without authorization between March 1 and December 31, 2020. However, only victims of the June 15–August 30, 2020 credential stuffing attacks—where data was either accessed or used fraudulently—may qualify for payments. Compensation varies by impact: - Access claims: Up to $80 ($20/hour for 4 hours) for time spent addressing the breach. - Fraud claims: Up to $200 ($20/hour for 10 hours) if personal data was used for fraud (e.g., CERB fraud). - Special compensation fund: Up to $5,000 for out-of-pocket expenses (e.g., fraud losses, identity theft fees). Eligible individuals will receive instructions post-approval, with no immediate action required. The final payout amounts may be adjusted based on the number of claims.

The governments of Canada was exposed to the entire internet details of software bugs and security plans, as well as passwords for servers, official internet domains, conference calls, and an event-planning system by misconfiguring pages on Trello, a project management website. 25 Canadian government trello boards had sensitive information, such as remote file access, or FTP, credentials, and login details for the Eventbrite event-planning platform. The government of Canada said, Departments and agencies of the Government of Canada must apply adequate security controls to protect their users, information, and assets. Employees are being reminded of their obligation never to communicate or store sensitive information on Trello boards or any other unauthorized digital tool or service.

Several Canadian government websites and servers were targeted in a cyberattack by the hacking group Anonymous. The attack affected several websites for government services, including canada.ca, as well as the site of Canada’s spy agency, the Canadian Security Intelligence Service (CSIS). The attack was aimed to show their retaliation for a new anti-terrorism law passed by Canada’s politicians.