Was your CRA profile hacked? A $8.7M lawsuit settlement claim is now open

Most serious cases for those affected in 2020 could be eligible for $5,000

Nothing in this life is certain, except for death — and maybe getting a payout if you were hacked for paying taxes.

The claims process is now open for those seeking their share of a $8.7-million settlement in a class-action lawsuit involving tens of thousands of Canadians whose sensitive information was compromised or stolen in 2020, when hackers got into their accounts on government websites, including the Canada Revenue Agency (CRA) portal.

Compensation could be as much as $5,000 for the most serious cases, according to the details posted by KPMG, the administrator for the lawsuit.

"This settlement has been found to be fair, reasonable, and in the best interests of the class members. It represents a compromise of disputed claims and is not an admission of wrongdoing," the Treasury Board of Canada Secretariat said in a statement posted Tuesday.

Hackers targeted government accounts over several months in 2020 largely for the purpose of applying for financial aid in the victims' names during the earliest months of the COVID-19 pandemic, including the Canada Emergency Relief Benefit (CERB) or the Canada Emergency Student Benefit (CESB).

Tens of thousands of people had their personal and financial information compromised that summer alone, from social insurance numbers and home addresses, to details of their bank accounts.

The class-action settlement reached last December and was approved in court in May. The claims process opened Tuesday.

Eligible class members can submit their claims online or by mail until Feb. 3, 2027.

Thousands of CRA accounts hacked in cyberattack

It's important to note that not all class members are eligible for payments under the settlement agreement, KPMG points out.

Class members are those whose personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and Dec. 31, 2020.

Canadian government to pay $8.7M to settle data breach class-action involving CRA accounts

CRA shuts down online services after thousands of accounts breached in cyberattacks

But only those class members who were victims of unauthorized access between June 15 and Aug. 13, 2020, and whose personal information was accessed, or accessed and used for fraudulent purposes, are entitled to payments, KPMG said.

You’re also eligible if you received a notice from KPMG.

You can check your eligibility on the KGMP website's eligibility page, where you will be asked to provide your last name and the last three digits of your social insurance number.

There are three classes of applicants:

Payment amounts may be reduced depending on the number of approved claims, according to a notice from the Federal Court of Canada.

Eligible claimants can apply on the KPMG website. You can also download a claim form on the website, or email breachsettlementcanada@kpmg.ca for more information.

If there's any money from the settlement amount left over or left unclaimed, Ottawa agreed to donate the excess to the Privacy and Access Council of Canada to fund privacy research.

The Government of Canada has denied any wrongdoing.

Natalie Stechyson has been a writer and editor at CBC News since 2021. She covers stories on social trends, families, gender, human interest, as well as general news. She's worked as a journalist since 2009, with stints at the Globe and Mail and Postmedia News, among others. Before joining CBC News, she was the parents editor at HuffPost Canada, where she won a silver Canadian Online Publishing Award for her work on pregnancy loss. You can reach her at natalie.stechyson@cbc.ca.

With files from Rhianna Schmunk