The federal government has settled a class action lawsuit for more than $8.7 million after hackers accessed sensitive information from several government websites, including the Canada Revenue Agency (CRA). The settlement, approved by the court, resolves claims stemming from a cyber breach that occurred between March 1 and December 31, 2020.
Background of the Breach
During the early months of the COVID-19 pandemic, cybercriminals managed to infiltrate approximately 47,000 online government accounts. This unauthorized access allowed them to apply for emergency benefits such as the Canadian Emergency Relief Benefit (CERB) and the Canadian Emergency Student Benefit (CESB). According to court documents, the exposed personal and financial information included social insurance numbers, direct deposit banking details, tax records, dates of birth, employment records, and employment insurance data.
Terms of the Settlement
The government will pay a total of $8,760,500.90 to settle the claims. This amount covers compensation for victims, associated taxes, and legal fees. Eligible claimants are automatically included in the settlement and do not need to take any action to receive their compensation.
Compensation Structure
- Financial Fraud Victims: Individuals whose information was used for financial fraud can receive up to $200.
- Access Without Fraud: Those whose information was accessed but not used for fraudulent purposes can receive up to $80.
- Out-of-Pocket Expenses: A special fund provides up to $5,000 per person for those who incurred direct expenses related to the breach.
Eligibility and Automatic Inclusion
Anyone whose personal or financial information was compromised through a government account during the specified period qualifies for compensation. The settlement is designed to be accessible, with no requirement for victims to file claims or provide additional documentation.
This resolution marks a significant step in addressing the fallout from one of the largest cybersecurity incidents affecting Canadian government services. The settlement aims to provide financial redress to thousands of individuals whose sensitive data was exposed during a critical time.
