Second lawsuit launched against LifeLabs

VANCOUVER – A second class action lawsuit has been filed over the ransom-ware attack that targeted the laboratory testing company LifeLabs, this time in B.C. Supreme Court. An earlier class action was initiated in Ontario in December.

The proposed British Columbia class action was filed on behalf of Anna Belle Tharani, a B.C. care aide who was among the millions of Canadians whose personal information was potentially compromised in the data breach.

Tharani’s lawsuit argues that LifeLabs lacked “adequate security” and “adequate training for employees” ahead of the attack, and that the company should have notified customers sooner after it happened.

LifeLabs notified B.C.’s Information and Privacy Commissioner about the breach on Nov. 1, but the public was not made aware until mid-December, CTV News reported.

That delay potentially exposed customers to “additional, unnecessary risks of harm,” according to the claim.

LifeLabs has not filed a statement of defence in the case, and has not responded to a request for comment from CTV News. None of the claims in Tharani’s lawsuit have been proven.

B.C. Health Minister Adrian Dix previously said the company requested some time before making the breach public because it wanted to first ensure its systems were secure and not vulnerable to secondary attacks.

“There was a delay to ensure that information that hadn’t been compromised wouldn’t be compromised and information that could be protected was protected,” Dix told reporters earlier this month.

The cyberattack affected systems containing information on about 15 million customers across Canada, including up to five million in B.C. The criminals responsible demanded a ransom, which the company paid in the hopes of retrieving the data.

LifeLabs CEO Charles Brown offered an apology to customers in the wake of the attack, and said the company brought in cybersecurity experts to investigate what happened and help restore security.

“I want to emphasize that at this time, our cyber security firms have advised that the risk to our customers in connection with this cyber-attack is low and that they have not seen any public disclosure of customer data as part of their investigations, including monitoring of the dark web and other online locations,” Brown said in a statement.

Meanwhile, in Ontario, Waddell Phillips PC and Klein & Schonblum Associates launched a national privacy breach class action against LifeLabs and associated companies on behalf of the estimated 15 million Canadians whose personal information, including highly sensitive health information, was compromised in the cyber attack.

The cyber criminals demanded, and LifeLabs subsequently paid, an undisclosed amount as a ransom in an attempt to secure the data. The compromised information includes, but is not limited to, medical lab test results, health card numbers, names, addresses, emails, login information, passwords, and dates of birth.

LifeLabs is one of the largest medical testing companies in the world, providing diagnostic medical testing services, including specimen collection, laboratory testing, and reporting of results to patients and health practitioners, across Canada. Each year, LifeLabs performs over 112 million laboratory tests on Canadians.

It was not until December 17, 2019, almost two months after the attack occurred, that LifeLabs first made a public announcement about the attack and the subsequent privacy breach.

“Healthcare records, and in particular lab test results, are some of the most private and sensitive personal information a company can hold. Unauthorized access and use can be devastating,” said David Fogel, a lawyer with Klein & Schonblum Associates. “It is extremely distressing that not only did LifeLabs fail to protect the personal health information of its clients, but that it took them almost two months to tell the public about it.”

“The scale of the LifeLabs privacy breach is truly massive – it affects over three quarters of all Ontarians and British Columbians,” said Cory Wanless, a lawyer with Waddell Phillips. “Basically anyone in Ontario or BC who has gone for any form of medical testing over the past several years is affected.”

The class action team is being led by Margaret Waddell. Ms. Waddell, founding partner of Waddell Phillips, is recognized by multiple lawyer ranking agencies as a leader in plaintiff-side class actions, and has acted as class counsel on a number of prominent cases.