British Columbia

CRA's handling of COVID-19 benefit cyberattacks 'reprehensible,' alleges proposed class-action lawsuit

If you applied for financial help during the COVID-19 pandemic under the CERB and CESB benefits programs, you might have had your identity stolen — and you're included in a proposed class-action lawsuit aimed at getting some compensation.

Compensation sought for at least 14,500 CERB and CESB applicants whose identities may have been stolen

Ally Scott, 19, is one of three lead plaintiffs alleging she was among at least 14,500 victims of cyberattacks on government online accounts. (Submitted by Sydney Scott)

A proposed class-action lawsuit has been launched against the federal government on behalf of Canadians who applied online for COVID-19 emergency aid — only to have their personal and financial information stolen by hackers.

The lawsuit alleges that a series of "failings" by the government and the Canada Revenue Agency (CRA) allowed at least three cyberattacks between mid-March and mid-August, but the public wasn't alerted until CBC News broke the story on Aug. 15.

The Treasury Board and the CRA held a news briefing to confirm the security breaches Aug. 17.

The proposed class proceeding claims the delayed detection of the hacks caused the number of victims to balloon to at least 14,500.

"The actions of the [CRA] are reprehensible," states the claim, "and showed a callous disregard for the rights of [victims]." 

It alleges the agency's conduct was "a deliberate ... departure from ordinary standards of decent behaviour, and as such merits punishment."

The Canada Revenue Agency says it was the target of at least three security hacks up until mid-August. (Adrian Wyld/The Canadian Press)

The CRA has blamed "a vulnerability in security software" for the online breaches, and has said it wasn't aware of the first cyberattack until Aug. 7.

The agency and the federal government have yet to file a legal response.

The Ministry of National Revenue said it cannot comment as the matter is now before the courts.

CERB, CESB benefits 'implemented hastily'

Most of the victims of the security breaches were applying for financial assistance under the Canadian Emergency Relief Benefit (CERB) or the Canadian Emergency Student Benefit (CESB). 

Both programs pay recipients up to $2,000 a month.

The legal action alleges the CERB and CESB were "implemented hastily," without adequate security measures.

As a result, it claims hackers were able to steal the personal information of applicants — including social insurance numbers, home addresses, bank account details and tax information — and use the stolen data to impersonate victims, change addresses and direct deposit information and file fraudulent claims under the emergency programs.

The lawsuit alleges the victims have been hit with a double whammy: their aid applications have been frozen while the breaches are investigated, causing financial strain, plus they will have to guard against identity theft for the rest of their lives.

Canadians attempting to log in to their Canada Revenue Agency accounts were initially met with a message informing them that they would not be able to access their accounts. (CBC News)

'Stressed out and anxious'

Three lead plaintiffs in the case, representing all affected Canadians, say they now live in fear their stolen data could be used for years by cyber criminals.

"I'm definitely stressed out and anxious because I don't know who has my information and I don't know who can get a copy of my information," said Ally Scott, who had applied for the student benefit.

"I am only 19 years old. I'm worried that I'm going to have to combat this issue for the rest of my life. And that seems pretty daunting."

'Somebody, somewhere has gotten $4,000'

Another plaintiff, a police dispatcher in Windsor, Ont., wasn't even eligible to receive emergency funds as an essential worker, but had her identity stolen and used to obtain benefits for two months.

"Somebody, somewhere, has gotten $4,000 of payments and I don't want that to be attached to my social insurance number, because I didn't apply for it. I don't qualify," said Anne Campeau, 52.

Campeau said she felt compelled to step forward and represent herself and other victims.

"I believe [the CRA] dropped the ball when they came to dealing with it," she said. "Sometimes you just gotta do something like this [proposed lawsuit] to get their attention. It's not right."

Anne Campeau, a police dispatcher in Windsor, Ont., says someone stole her identity to obtain $4,000 in COVID-19 financial aid. (Submitted by Anne Campeau)

Compensation sought for all victims

The proposed class proceeding, filed Aug. 24 in Federal Court in Vancouver, blames the government and CRA for negligence and breach of privacy.

Angela Bespflug, the lawyer handling the case, believes there are more victims out there.

"A lot of individuals had no idea this was going on and their personal financial information was being compromised," said Bespflug. "I suspect it's a significant number of individuals, unfortunately."

If given approval to proceed, the lawsuit will pursue financial compensation for all victims to cover damage to credit ratings, the ongoing cost of credit monitoring and for mental distress, stress and anxiety.

No date has been set for a hearing, and none of the allegations have been proven in court.

Receiving certification for a class-action lawsuit can take months or years.
 

CBC Vancouver's Impact Team investigates and reports on stories that impact people in their local community and strives to hold individuals, institutions and organizations to account. If you have a story for us, email impact@cbc.ca.

 

About the Author

Eric Rankin

Investigative journalist

Eric Rankin is an award-winning CBC reporter. His honours include the 2018 Canadian Screen Award for Best Local Reportage, the 2017 and 2015 RTDNA awards for Best In-depth/Investigative Reporting, and the 2009 Jack Webster award for Best News Reporting.

Add some “good” to your morning and evening.

A variety of newsletters you'll love, delivered straight to you.

Sign up now

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

now