2020 CRA — credential stuffing, 48,500 accounts; 2026 $8.7M settlement claims open
Data compromised
SINs, tax information, personal data
Technical writeup
Credential stuffing attack on CRA and related government portals. Attackers used credentials from prior breaches to access My Account, My Business Account, Represent a Client. SINs and other tax data potentially exposed. Settlement update (2026): Federal Court approved an ~$8.7M class-action settlement (Sweet v. HMK, T-982-20) over 2020 credential-stuffing against GCKey/CRA My Account; claims window opened August 4, 2026 via breachsettlementcanada.kpmg.ca (up to $5,000 for eligible class members). Settlement is not an admission of liability.
Root cause
Credential stuffing
References
- https://www.cbc.ca/news/politics/cra-cyberattack-credential-stuffing-1.5692468
- https://www.canada.ca/en/government/system/digital-government/online-security-privacy/sweet-hmk-class-action-suit/notice-settlement-approval-sweet-v-his-majesty-king-federal-court-file-t-982-20.html
- https://www.breachsettlementcanada.kpmg.ca/en/details
- https://dailyhive.com/canada/cra-settlement-claims-open