Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

A CRA sign regarding the CRA class action lawsuit filed after several data breaches

The federal government and the Canada Revenue Agency are facing a class action lawsuit over a series of cyberattacks that affected Canadians who applied online for emergency aid during the COVID-19 pandemic.

The cyberattacks reportedly affected individuals who had applied for financial assistance from the Canadian Emergency Relief Benefit (CERB) or the Canadian Emergency Student Benefit (CESB), which pays recipients up to $2,000 per month.

Cyberattack Puts Consumer Data At Risk of Identity Theft, Fraud

According to the CRA class action lawsuit Canada, which was filed Aug. 24 in Vancouver federal court, there were at least three cyberattacks between mid-March and mid-August that reportedly resulted in the theft of applicants’ personal and financial information.

According to the CRA class action lawsuit, the information stolen from the data breach includes social insurance numbers, home addresses, tax information, and bank account details. As a result, the hackers were allegedly able to use this data to commit identity theft, change direct deposit information, and file fraudulent claims under the COVID-19 relief programs.

The public was reportedly not notified of this data theft until Aug. 15 when CBC News first reported about the cyberattack.

On Aug. 17, the Treasury Board and CRA confirmed the security breaches during a news briefing. The cyber attacks reportedly targeted the CRA and GCKey, an online portal that allows access to services such as employment insurance, immigration applications and veterans’ benefits.

The hackers were allegedly able to use previously hacked credentials to access users’ CRA accounts. The affected accounts were reportedly cancelled once the data breach was discovered, and users whose credentials were compromised will be provided with instructions to get a new GCKey.

According to the CRA data breach class action lawsuit, at least 14,500 Canadians may be affected by the data breach.

Data Breach Class Action Calls CRA’s Actions “Reprehensible”

The plaintiffs reportedly call the CRA’s actions “reprehensible” and that they “showed a callous disregard” for the victims’ rights.Woman shocked about a data breach regarding the CRA class action lawsuit filed

Further, the CRA data breach class action lawsuit alleges that CRA’s actions constituted a “departure from ordinary standards of decent behaviour” and deserve to be punished.

The CRA, for its part, says that “a vulnerability in security software” is to blame for the data breaches and that the agency did not learn of the first cyberattack until Aug. 7.

The CRA data breach class action lawsuit claims that the CERB and CESB were “implemented hastily” without adequate safeguards to protect consumers’ data.

While the data breaches are being investigated, applications to the aid programs have reportedly been frozen, causing them further financial hardship. To make matters worse, those affected will have to be vigilant about the risk of identity theft throughout their lifetimes.

“I’m definitely stressed out and anxious because I don’t know who has my information and I don’t know who can get a copy of my information,” says plaintiff Ally Scott. She says she applied for CESB.

“I’m only 19 years old. I’m worried that I’m going to have to combat this issue for the rest of my life. And that seems pretty daunting.”

Plaintiff Anne Campeau of Windsor, Ontario, says she wasn’t even eligible for emergency funds because she is an essential worker. However, she says her identity was stolen and the thief was able to obtain benefits under her name for two months.

“Somebody, somewhere, has gotten $4,000 of payments and I don’t want that to be attached to my social insurance number, because I didn’t apply for it,” Anne says. “I don’t qualify.”

The CRA data breach class action lawsuit seeks compensation to cover the cost of credit monitoring, damage to victims’ credit ratings, and for mental distress, stress and anxiety.

Consumers Targeted by COVID-19 Fraud

The COVID-19 pandemic has created an opportunity for bad actors to cash in on consumers’ fear and uncertainty. On April 14, Health Canada warned that Canadians were being sold fraudulent and unauthorized N95 respirators that were marketed as providing protection against COVID-19.

Health Canada said it had received reports that the respirators weren’t certified under its Class I medical device regulations or by the U.S. National Institute for Occupational Safety and Health (NIOSH).

“Fraudulent or unauthorized N95 masks may not meet the same performance measures required by the NIOSH N95 standard and, as a result, may not properly protect consumers from COVID-19,” Health Canada warned.

The “N95” designation means that the respirator has been carefully tested to ensure that it blocks at least 95% of small test particles, such as pathogens, Health Canada explained.

Health Canada has also warned consumers about the risks of homemade hand sanitizers and urged consumers to only use hand sanitizers with at least 60% alcohol that had been approved by the agency, if soap and water are not available, to limit the spread of COVID-19.

CBC News reports that seniors may be particularly vulnerable to fraud during the COVID-19 pandemic. Since many seniors are in isolation during this time, there is concern that there are more opportunities for them to become a victim of a scam. 

“The concern was because of the lock down, certain fraudsters…will it try to ingratiate themselves with, you know, under the guise of coming in to assist with even, you know, buying groceries or helping in that sense,” Lilian Bahgat, Community Legal Aid review counsel, told CBC reporters.

What do you think about the CRA data breach class action lawsuit? Have you been a victim of a data breach or fraud since the COVID-19 pandemic began? Tell us your story in the comment section below! 

We tell you about cash you can claim EVERY WEEK! Sign up for our free newsletter.

  • This field is for validation purposes and should be left unchanged.


23 thoughts onCRA Targeted in Class Action Lawsuit After a Series of Cyberattacks

  1. Kevin Flegel says:

    Yes Please sign me up . i had my SIN, now i am on the hook for someone else theft.n I reported it to CRA and the Local police and filed a report . But not solved yet.

  2. Susan Ross says:

    I want to join this lawsuit. Please contact me to do so. I am in Ontario. I have all documents supporting my claims. I am very vulnerable now and want justice.

  3. Susan Ross says:

    I had my data breached as of 2020 after I did my taxes for 2019 at H&R block. Someone took my identity changed me to common law via CRA and took out $6000 dollars in benefits for covid 19 relief monies. They changed info in my bank accounts and it took me til this last summer to get cleared. But my info is out there. Now my bank is watching me for fraud. I have police harassing me. And I am a victim who was cleared but suffered and still am. Unable to work because of the slander by police and records. It has financially ruined me. I want to join this suit. I have all the paperwork to prove it.

  4. Michelle says:

    Its been nothing but a nightmare since I found out by the CRA that my account was included in 3 attacks. Could not wait on hold to talk to someone for more than the 2.5 hrs. First 2x times that I did try my call was dropped after over 2 hours on hold. Almost 3 yrs to get back into my account. Could not apply for my remaining CERB benefits. When I was finally able to get back into my account the dates had past to apply. Out 2 yrs of CERB benefits… Please add me.

    1. Susan Ross says:

      The same thing happened to me. Exactly. They took all my Gst ,and other benefits. It has been a nightmare.

  5. Paul B says:

    Still locked out of my account since 2020. They applied for the relief fund now they are sending me letter saying I didn’t qualify for it. I was not the one that applied. I have interest being added on to my balance. I would like to the lawsuit. My salary now is
    Being garnished.

  6. LLOYD MICHAEL HAMILTON says:

    ADD ME PLEASE TO THE CRA CLASS ACTION LAWSUIT. I CANT EVEN LOG INTO MY CRA ACCOUNT EITHER FOR THE PAST 2 TO 3 YEARS. I HAD FRAUD OCCUR AGAINST ME DURING COVID WHERE THEIVES GOT CELL PHONES THREE DIFFERENT TIMES AND HAVE PROOF I WAS DEFRAUDED FROM EQUIFAX AND POLICE REPORTS FILED IN NEW WEST, BC

  7. Brooklynn Fryer says:

    I have been dealing with this since 2020. I didn’t receive my income tax and come to find out my account had been hacked. I’ve been on the phone a million times with the CRA, filed reports and done everything I could and am still getting the run around. They just keep telling me I applied for CERB. I am an essential worker and have been working throughout the whole pandemic. If they looked at my T4 they’d realize I took home over $40,000 both years why would I apply to CERB? I never received my income tax for this year either. Times are tough, I just moved out on my own and the price of living keeps going up. I need that money to live. If they can charge interest on money we owe them, they sure as heck should pay us interest on what were owed!

  8. Mathew Lappin says:

    Hi, I believe I was effected by this breach. Can someone let me know where I can sign up for the class action??1?!1

  9. Derek says:

    2 years later and I’m still locked out of my CRA account. I had access for a couple months in 2021, but I moved to a new address and forgot to change my address in the account. Since then, it’s been revoked, I’ve faxed and refaxed all of my identification as requested by the CRA beginning Feb 13th. I’ve called each week since and have been told that my address has not been updated, therefore I cannot receive the security code by mail that’s needed to retegister. I was told that because I was part of the data breach, my information needs to be verified by a 3rd party company and that they are to call me, I’ve been waiting months with no call, I call yh CRA wait on hold for 2-4hours, either get hung up on or told to call back later. I’ve had to take time off of work just to contact them due to insane wait times only to find out nothing has been done.
    I cannot access any tax information, notice of assessments, not sure how much(if any) that I owe, I’ve not received a refund so I assume I’m to pay back, how much? Not sure because I can’t get my info (this was before the due date for tax payments) now because I cannot access my account duento reasons stemming back to the security breach, I’m incurring penalties because I dont know how much I need to pay back.
    Do I get a GST? And how much? No idea, all that info is on the CRA My account.
    On top of all that, Im now forced to purchase credit monitoring services for the rest of my life to ensure the info that was stolen from the CRA isn’t being used elsewhere, and what happens when it is? Who’s responsible for the damages then?
    Not being able to access an essential government service because of their unwillingness TO UPDATE MY MAILING ADDRESS since the first request February 13th.

  10. Eliaza Weatherby says:

    I’ve had my bank account hacked and frauded as well as my MSCA and my CRA. I’ve had over $2000 taken from me. And been denied by the bank to have my money returned even though I have shown them proof of fraud. I called the Government as I couldn’t get into my accounts one afternoon, and the gentlemen I spoke with told me a different date as to when I signed in last that what the date originally should have been.

Leave a Reply

Your email address will not be published. By submitting your comment and contact information, you agree to receive marketing emails from Top Class Actions regarding this and/or similar lawsuits or settlements, and/or to be contacted by an attorney or law firm to discuss the details of your potential case at no charge to you if you qualify. Required fields are marked *

Please note: Top Class Actions is not a settlement administrator or law firm. Top Class Actions is a legal news source that reports on class action lawsuits, class action settlements, drug injury lawsuits and product liability lawsuits. Top Class Actions does not process claims and we cannot advise you on the status of any class action settlement claim. You must contact the settlement administrator or your attorney for any updates regarding your claim status, claim form or questions about when payments are expected to be mailed out.