Government of Canada Privacy Breach Class Action – Proposed Settlement

This class action concerns a privacy breach involving Government of Canada Online Accounts, where unauthorized third parties accessed personal and financial information between March 1, 2020, and December 31, 2020. The accounts include:

• Canada Revenue Agency (“My Account”)
• My Service Canada Account
• Other Government of Canada online accounts accessed using GCKey.

The lawsuit alleges inadequate safeguards allowed unauthorized access, and in some cases, fraudulent applications for benefits. The Government of Canada denies any wrongdoing.

You are a Class Member if:

• Your personal or financial information in a Government of Canada Online Account was disclosed to a third party without authorization during the specified period.
• This includes *“Excluded Persons” (those who contacted Murphy Battista LLP about the CRA privacy breach class action before June 24, 2021).

* Excluded Persons means all persons who contacted Murphy Battista LLP about the CRA privacy breach class action, with Federal Court file number T-982-20 prior to June 24, 2021.

Be advised that Excluded Persons are included in the Settlement.

It is important to understand that not all class members will be entitled to payments under the Proposed Settlement Agreement. Only those class members who were victims of unauthorized access by third parties to Class Members’ personal information contained in Government of Canada Online Accounts during the Credential Stuffing Attacks directed at the Government of Canada Online Accounts between June 15 and August 30, 2020 (the “Credential Stuffing Attacks”), and whose personal information was accessed, or accessed and used for fraudulent purposes, are entitled to payments under the Proposed Settlement Agreement.

If you received an e-mail with this Notice from the Claims Administrator, KPMG, you are eligible to apply for a payment under the Settlement Agreement. You can verify whether you are an eligible claimant by visiting the Eligibility page on or after January 15, 2026.

The settlement provides compensation for eligible Class Members:

• Access Claims: Up to $80 for time spent addressing unauthorized access of your personal financial information.
• Fraud Claims: Up to $200 for time spent addressing fraudulent use of your personal financial information.
• Special Compensation Fund: Up to $5,000 for out-of-pocket expenses related to fraudulent use of your personal financial information (e.g., unreimbursed fraud losses, identity theft costs, professional fees).

Eligibility will be determined based on whether your information was accessed during the Credential Stuffing Attacks (June 15 – August 30, 2020).

No. If you are a Class Member, you are automatically included unless you opt out. If the settlement is approved, you will receive instructions on how to apply for compensation.

If you do not want to participate and wish to pursue your own claim:

Complete the Opt-Out Form available in the Documents page.

Send it by mail, courier, email, or fax to:

• KPMG
  KPMG Tower
  600, de Maisonneuve Blvd. West
  Suite 1500
  Montréal, Québec H3A 0A3
  Attention: Canada Privacy Breach Class Action Administrator
• Email: optout.breachsettlementcanada@kpmg.ca
• Fax: 514-840-2390

Opt-Out Deadline: 11:59 p.m. PST on February 20, 2026

• Email submissions: deemed received by timestamp.
• Mail: postmark date applies; if illegible or not postmarked, forms received within 7 business days after the deadline will be accepted.
• Fax/courier: deemed received on date marked as received.

If you wish to object, submit a written objection by email, mail, courier, or fax to:

• KPMG
  KPMG Tower
  600, de Maisonneuve Blvd. West
  Suite 1500
  Montréal, Québec H3A 0A3
  Attention: Canada Privacy Breach Class Action Administrator
• Email: objection.breachsettlementcanada@kpmg.ca
• Fax: 514-840-2390

Objections Deadline: 11:59 p.m. PST on February 20, 2026

• Email submissions: deemed received by timestamp.
• Mail: postmark date applies; if illegible or not postmarked, forms received within 7 business days after the deadline will be accepted.
• Fax/courier: deemed received on date marked as received.

Your objection must include:

• Full name
• Mailing address
• Telephone number
• Email address
• A brief statement of the nature and reasons for your objection
• A declaration that you believe you are a Class Member and why
• Whether you intend to appear at the Approval Hearing (in person or by counsel)
• If represented by counsel: include counsel’s name, address, phone, fax, and email

Date: March 31, 2026

Time: 9:30 a.m. Pacific Time

Location: Federal Court, Pacific Centre, 701 West Georgia Street, Vancouver, BC

Virtual Option: Videoconference via Microsoft Teams link to be provided at a later date.

If you do nothing, you remain a Class Member. If the settlement is approved, you will receive instructions on how to apply for compensation.

• Access Claims: $20/hour for up to 4 hours (maximum $80).
• Fraud Claims: $20/hour for up to 10 hours (maximum $200).
• Special Compensation Fund: Up to $5,000 for documented out-of-pocket expenses.

Amounts may be reduced depending on the number of claims submitted.

• Visit www.breachsettlementcanada.kpmg.ca
• Email breachsettlementcanada@kpmg.ca
• Phone 1-833-724-6160

Contact Class Counsel:

• RICE HARBUT ELLIOTT LLP,
  Suite #820 – 980 Howe Street,
  Vancouver, BC, V6Z 0C8.
  
• Class Counsel Email: classactions@rhelaw.com