Canada Settles CRA Credential-Stuffing Breach

Canada has approved an $8.

7 million class-action settlement linked to 2020 credential-stuffing attacks against Canada Revenue Agency and other Government of Canada online accounts. The attacks used credentials obtained from unrelated breaches and affected tens of thousands of account holders, with some accounts allegedly used in fraudulent benefit applications. The settlement creates a claims process for eligible Canadians and may reimburse documented costs, fraud losses, and time spent responding to unauthorized access.