Canada Settles Class-Action Lawsuit Over 2020 CRA Data Breach for $8.7M

Severity: Medium (Score: 51.1)

Sources: rhelaw.com, www.cbc.ca, Dailyhive, Uk.News.Yahoo

Summary

The Canadian government has agreed to pay $8.7 million to settle a class-action lawsuit stemming from a data breach that affected over 47,000 Canadians in 2020. Hackers exploited 'credential stuffing' techniques to gain unauthorized access to government online accounts, including the Canada Revenue Agency (CRA) portal. Victims had their personal and financial information compromised, leading to fraudulent applications for financial aid during the COVID-19 pandemic. The Federal Court approved the settlement on May 5, 2026, deeming it fair and reasonable. The breach highlighted the government's inadequate security measures, which allowed hackers to impersonate victims and divert funds. Affected individuals can claim compensation, with some eligible for up to $5,000. The CRA has faced criticism for its failure to secure sensitive data effectively. The settlement concludes a lengthy legal battle initiated by lead plaintiff Todd Sweet, who discovered the breach in July 2020. Key Points: • The Canadian government will pay $8.7 million to settle a data breach class-action lawsuit. • Over 47,000 Canadians had their personal information compromised due to credential stuffing attacks. • Victims can claim compensation, with some eligible for up to $5,000 based on their losses.

Key Entities

• Credential Stuffing (attack_type)
• Data Breach (attack_type)
• Canada Revenue Agency (company)
• Government Of Canada (company)
• KPMG (company)
• Murphy Battista LLP (company)
• Treasury Board Of Canada Secretariat (company)
• Canada (country)
• CWE-200 - Exposure of Sensitive Information (cwe)
• Government (industry)
• T1078 - Valid Accounts (mitre_attack)
• T1110 - Brute Force (mitre_attack)
• GCKey (platform)