Government of Canada

Credential-stuffing attacks in 2020 let unauthorized parties access Canadians' CRA, Service Canada, and GCKey accounts due to alleged inadequate safeguards.

This class action concerns credential-stuffing attacks in 2020 in which unauthorized third parties used stolen credentials to access Canadians' Government of Canada online accounts — including CRA My Account, My Service Canada Account, and GCKey — due to alleged inadequate safeguards. The Government of Canada agreed to a $8,760,500.90 settlement, which the Federal Court approved on May 5, 2026. The claim period had not opened as of mid-June 2026, and the claim deadline will be announced on the official settlement website. Eligible class members can claim up to $80 for time spent, up to $200 for fraudulent use of their information, and up to $5,000 for documented out-of-pocket expenses.

• People whose personal or financial information in a CRA My Account, My Service Canada Account, or GCKey account was accessed without authorization between March 1 and December 31, 2020.
• Claimants generally experienced unauthorized access between June 15 and August 30, 2020, with information accessed or used fraudulently.