Canadian government to pay $8.7 million in CRA data breach settlement

The federal government will pay $8.7 million to settle a classaction lawsuit tied to a 2020 breach that exposed the personal information of tens of thousands of Canadians through government accounts, including the Canada Revenue Agency’s MyAccount portal. Court records say hackers used stolen login credentials to access accounts over several months during the early COVID19 period, when they also tried to file fraudulent claims for emergency benefits such as CERB and CESB. More than 47,000 people were affected in one summer alone, with information including social insurance numbers, addresses and bank details compromised. A federal court approved the settlement this week, ending a legal dispute that accused the government and the CRA of failing to secure the system and detect the breach quickly. The settlement sets aside about $6 million for affected account holders, while the rest covers legal fees and administration. Eligible claimants may receive compensation for time lost, fraudrelated issues and some outofpocket costs, and any leftover funds will go to privacy research.