Privacy & Security
Proposed class-action lawsuit seeks damages in NL
January 3, 2024
ST. JOHN’S, NL – A proposed class-action lawsuit has been filed over the cyberattack on Newfoundland and Labrador’s healthcare system that took place in the fall of 2021. The attack, carried out by cyber-thieves affiliated with the Hive ransomware group, stole both personal medical information as well as employee information from thousands of people.
The Office of the Information and Privacy Commissioner called it the largest hack of its kind in the province, and one of the largest in Canada to date. A report released in May from the office found that security deficiencies were known well before the cyberattack took place and were not corrected by officials.
Lawyers Bob Buckingham (pictured) and Eli Baker filed a statement of claim at the Supreme Court of Newfoundland and Labrador on Nov. 9 on behalf of two plaintiffs, Fred Harnum and Allison George.
The defendants are listed as Newfoundland and Labrador Health Services and the provincial Department of Health and Community Services.
“People have been terrified about this. People have heard about breaches of privacy in the past, but in this case personal, private medical information has been stolen,” Buckingham told CBC News.
He said “nefarious people” were behind the attack and members of the public have been left to wonder how their information might be misused, including to create fake identities.
“And we don’t know, in this particular case, if the government has, you know, paid a ransom on this or if they have any guarantees that the information is not going to be used. People are very worried,” he said.
Buckingham said his firm has been contacted by several people who have been impacted by the breach.
He pointed to “historical systemic negligence on the part of the government and the health services, and also a breach of confidence in terms of how they handled the information.”
“But in particular, the government and health services have known for at least 12 years that there have been deficiencies and how they’ve been recording information and protecting it,” he said.
As a result, there was a cyberattack and people have suffered because of it. He said once the class-action lawsuit is certified, the two lead plaintiffs will represent all of the people impacted by the cyberattack.
N.L. Health Services spokesperson Mikaela Etchegary and Department of Health and Community Services spokesperson Tina Coffey both declined to comment, as the matter is before the courts.
Buckingham and Baker are also seeking damages, and while the statement of claim didn’t give a figure, Buckingham said the amount “could be significant” and that it could result in thousands of dollars for each person.
“How that’s going to work out is going to be an interesting question in terms of whether people get that money or we negotiate some sort of remedy that is appropriate in the circumstances. But it’s substantial given the level of the negligence,” said Buckingham.
He added a message has to be sent to the provincial government, among other governments, that they need to protect people’s personal information.
According to a Office of the Information and Privacy Commissioner report released in May, an estimated 106,311 people have been impacted by the attack.
When asked how many people could see a financial return if the lawsuit is successful, Buckingham said “Look, there’s just so many that they have been able to totally quantify, but in essence, perhaps almost everyone in the province.”