On May 5, 2026, the Federal Court approved an $8.7 million class-action settlement for Canadians impacted by a privacy breach of Government of Canada online accounts, including the CRA’s My Account. The breach, resulting from "credential stuffing" attacks between March 1 and December 31, 2020, allowed unauthorized access to personal and financial information. Individuals whose data was accessed may be eligible for up to $80 for inconvenience, or up to $200 if their information was used for fraudulent purposes, such as CERB benefit applications. Those who incurred out-of-pocket expenses due to the breach can apply for reimbursement of up to $5,000. KPMG is administering the settlement, and while class members are automatically included, they will be notified on how to apply for compensation.