$8.7M Settlement Opens for Canadians Affected by 2020 Government Data Breach A class-action settlement worth $8.7 million is now open for Canadians whose personal and financial data was compromised in a 2020 cyberattack targeting government accounts, including the Canada Revenue Agency (CRA) portal. The breach, which occurred over several months, saw hackers exploit vulnerabilities to access sensitive information such as social insurance numbers, home addresses, and bank details primarily to fraudulently apply for COVID-19 emergency benefits, including the Canada Emergency Relief Benefit (CERB) and Canada Emergency Student Benefit (CESB). The settlement, approved by the Federal Court in May 2024 after being finalized in December 2023, offers compensation of up to $5,000 for the most severe cases. Payments are structured into three tiers: - Up to $80 for those whose data was accessed but not used fraudulently. - Up to $200 for victims of fraudulent use. - Up to $5,000 for out-of-pocket expenses (e.g., identity theft-related costs) incurred within a year of the breach. Eligibility is limited to individuals whose accounts were compromised between March 1 and December 31, 2020, with a narrower window of June 15 to August 13, 2020, for those entitled to payments. Claimants must also have received a notice from KPMG, the settlement administrator, or verify eligibility using their last name and the last three digits of their social insurance number. The claims process, which opened on June 11, 2024, runs until February 3, 2027. Applications can be submitted online, by mail, or via email to [email protected]. Any unclaimed funds will be donated to the Privacy and Access Council of Canada for privacy research. The Treasury Board of Canada Secretariat has emphasized that the settlement is a compromise of disputed claims and does not constitute an admission of wrongdoing by the government. The breach, which affected tens of thousands of Canadians, prompted the CRA to temporarily shut down online services in 2020 amid concerns over security vulnerabilities.