$8.7M Settlement Opens for Canadians Affected by 2020 Government Data Breach
A class-action settlement worth $8.7 million is now open for Canadians whose personal and financial data was compromised in a 2020 cyberattack targeting government accounts, including the Canada Revenue Agency (CRA) portal. The breach, which occurred over several months, saw hackers exploit vulnerabilities to access sensitive information such as social insurance numbers, home addresses, and bank details primarily to fraudulently apply for COVID-19 emergency benefits, including the Canada Emergency Relief Benefit (CERB) and Canada Emergency Student Benefit (CESB).
The settlement, approved by the Federal Court in May 2024 after being finalized in December 2023, offers compensation of up to $5,000 for the most severe cases. Payments are structured into three tiers:
- Up to $80 for those whose data was accessed but not used fraudulently.
- Up to $200 for victims of fraudulent use.
- Up to $5,000 for out-of-pocket expenses (e.g., identity theft-related costs) incurred within a year of the breach.
Eligibility is limited to individuals whose accounts were compromised between March 1 and December 31, 2020, with a narrower window of June 15 to August 13, 2020, for those entitled to payments. Claimants must also have received a notice from KPMG, the settlement administrator, or verify eligibility using their last name and the last three digits of their social insurance number.
The claims process, which opened on June 11, 2024, runs until February 3, 2027. Applications can be submitted online, by mail, or via email to breachsettlementcanada@kpmg.ca. Any unclaimed funds will be donated to the Privacy and Access Council of Canada for privacy research.
The Treasury Board of Canada Secretariat has emphasized that the settlement is a compromise of disputed claims and does not constitute an admission of wrongdoing by the government. The breach, which affected tens of thousands of Canadians, prompted the CRA to temporarily shut down online services in 2020 amid concerns over security vulnerabilities.
Source: https://www.cbc.ca/news/canada/cra-hacked-lawsuit-compensation-9.7298086
Treasury Board of Canada Secretariat | Secrétariat du Conseil du Trésor du Canada cybersecurity rating report: https://www.rankiteo.com/company/tbs-sct
"id": "TBS1786048347",
"linkid": "tbs-sct",
"type": "Breach",
"date": "3/2020",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Tens of thousands of Canadians',
'industry': 'Public Sector',
'location': 'Canada',
'name': 'Canada Revenue Agency (CRA)',
'size': 'Large',
'type': 'Government Agency'}],
'attack_vector': 'Vulnerability Exploitation',
'customer_advisories': 'Notices sent to affected individuals via KPMG',
'data_breach': {'data_exfiltration': 'Used for fraudulent benefit '
'applications',
'number_of_records_exposed': 'Tens of thousands',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Social insurance numbers',
'Home addresses',
'Bank details']},
'date_detected': '2020-03-01',
'description': 'A class-action settlement worth $8.7 million is now open for '
'Canadians whose personal and financial data was compromised '
'in a 2020 cyberattack targeting government accounts, '
'including the Canada Revenue Agency (CRA) portal. Hackers '
'exploited vulnerabilities to access sensitive information '
'such as social insurance numbers, home addresses, and bank '
'details, primarily to fraudulently apply for COVID-19 '
'emergency benefits.',
'impact': {'brand_reputation_impact': 'Government trust erosion',
'data_compromised': 'Social insurance numbers, home addresses, '
'bank details',
'downtime': 'Temporary shutdown of online services in 2020',
'financial_loss': '$8.7M settlement fund',
'identity_theft_risk': 'High (social insurance numbers and bank '
'details exposed)',
'legal_liabilities': 'Class-action settlement',
'operational_impact': 'Fraudulent applications for COVID-19 '
'emergency benefits',
'payment_information_risk': 'High (bank details exposed)',
'systems_affected': 'Canada Revenue Agency (CRA) portal'},
'investigation_status': 'Settlement finalized',
'motivation': 'Financial Gain',
'post_incident_analysis': {'root_causes': 'Security vulnerabilities in CRA '
'portal'},
'references': [{'source': 'Federal Court Settlement Approval'}],
'regulatory_compliance': {'legal_actions': 'Class-action lawsuit'},
'response': {'communication_strategy': 'Notices sent to affected individuals, '
'public announcements',
'containment_measures': 'Temporary shutdown of online services',
'third_party_assistance': 'KPMG (settlement administrator)'},
'title': '2020 Government Data Breach Affecting Canadians',
'type': 'Data Breach'}