Government Pays $8.7 Million in Cra Class Action Lawsuit

Canada will pay $8.7 million in the cra class action lawsuit over a 2020 breach that hit CRA accounts. The settlement covers more than 48,000 Canadians whose personal and financial information was compromised, including social insurance numbers, home addresses and bank details. The court approved the deal on Tuesday after it was reached last December.

Todd Sweet and the breach

Todd Sweet of Clinton, B.C., started the case after he found on July 2, 2020 that his CRA account had been hacked. He received emails saying changes had been made to his account, then found his direct deposit information had been altered and CERB applications had been filed in his name.

Sweet said the government "breached class members’ privacy by not properly safeguarding confidential personal and financial information" and that "inadequate safeguards allowed bad actors to access the online accounts of Canadians". Those claims turned the case from a single account intrusion into a broader challenge over how federal systems handled identity data.

Fraudulent benefits applications

Between June and August 2020, hackers targeted federal government accounts and used stolen information to apply for financial benefits in victims' names. The benefits included the Canadian Emergency Relief Benefit and the Canadian Emergency Student Benefit. Direct deposit changes and benefit applications gave the breach a practical cost beyond the initial account access.

More than 48,000 Canadians had their personal and financial information compromised in the incident. For anyone included in that group, the settlement is the latest development tied to a breach that exposed tax and banking details inside CRA-linked accounts, after unauthorized activity was discovered by users and pushed the dispute into class-action court.

Settlement approval on Tuesday

$8.7 million now stands as the government payment tied to the lawsuit, and the court approval on Tuesday turns last December's deal into an approved settlement. The case leaves one clear operational takeaway for affected Canadians: the breach was not limited to account access alone, but included direct deposit changes and benefit claims made in victims' names.