A 2020 data breach affecting CRA and Service Canada online accounts had resulted in a major class action, and a settlement of $8.76 million was reached, with payments of up to $5,000 available to some claimants.
Most Canadians will likely be looking at compensation of up to $80 or $200, with the larger payouts reserved for those who can document out-of-pocket losses related to fraud or identity theft.
The hack was the result of a credential-stuffing attack. This type of breach occurs when cybercriminals use usernames and passwords from other data breaches. It is a good reason to beware the risk of reusing passwords.
Who is entitled to compensation from the CRA settlement?
According to the Notice of Settlement Approval:
“All persons whose personal or financial information in their Government of Canada Online Account* was disclosed to a third party without authorization between March 1, 2020 and December 31, 2020.
* “Government of Canada Online Account” means:
- Canada Revenue Agency account;
- My Service Canada account; or
- Another Government of Canada online account accessed using the Government of Canada Branded Credential Service (GCKey).”
If you are not sure whether you received correspondence from the government on your data being breached six years ago, you can check the eligibility page from KPMG.
You will be asked to provide your last name, the last three digits of your social insurance number, and your email address.
Not all class members are entitled to compensation, so checking your eligibility before applying can save time and help you understand which compensation category may apply to you.
What are the CRA settlement compensation categories?
There are three different levels of compensation that depend on the impact resulting from the breach:
1. Access claims for those whose information was accessed are capped at $80.
2. Fraud claims for those whose identity information was used are up to $200.
3. A special compensation claim of up to $5,000 is available for those who can document their out-of-pocket expenses.
Most claimants will fit into the $80 or $200 categories, and even those amounts could be reduced depending on how many eligible claims are submitted.
It is also important to note that the $8.76 million headline settlement is not all going to claimants. The settlement amount includes legal fees, taxes, administration costs, disbursements, and other expenses that will reduce the funds available for applicants.
So, consider the $80 and $200 amounts as maximums, not guarantees.
