What Happened
Ottawa residents who had their Canada Revenue Agency accounts compromised in a wave of hacking incidents can now file a claim for compensation, after the claims process officially opened for an $8.7-million class-action lawsuit settlement. The lawsuit covers tens of thousands of Canadians whose CRA profiles were accessed without authorization, and the settlement is meant to compensate those affected for the fallout of the breach.
Why It Matters in Ottawa
As the seat of the federal government, Ottawa has one of the highest concentrations of public servants in the country, many of whom rely on CRA's My Account portal for direct deposit, benefit payments, and tax filing. That makes the capital region particularly exposed to any large-scale compromise of CRA login credentials. Local residents who noticed unauthorized changes to their CRA profile — such as altered direct deposit information, unexpected address changes, or benefit payments redirected without their knowledge — may be eligible to file a claim under this settlement.
How the Hack Happened
Mass CRA account hacks like this one typically stem from "credential stuffing," where scammers use usernames and passwords leaked from unrelated data breaches to try logging into government portals, banking on the fact that many people reuse passwords across sites. Once inside a CRA account, fraudsters have in the past redirected tax refunds, GST/HST credits, or COVID-era benefit payments to accounts they control.
What Ottawa Residents Should Do
Anyone in Ottawa who believes their CRA account was compromised should start by checking their CRA My Account for unfamiliar activity, including changes to banking information or mailing address, and confirm that all benefit payments have been going to the right place. Those affected are encouraged to look into the claims process for the settlement to determine eligibility and file before any deadline set out in the settlement terms.
In the meantime, Ottawa residents are reminded of standard account security practices: use a unique, strong password for their CRA account, enable multi-factor authentication where available, and monitor CRA correspondence closely for anything unexpected.
The Bigger Picture
This settlement is the latest reminder of how vulnerable government online services can be when users reuse passwords across multiple platforms. With so many Ottawa households connected to the federal government — either as employees or through routine dealings with the CRA — staying on top of account security remains one of the simplest ways to avoid becoming part of the next such lawsuit.
Source: CBC Ottawa
