Proposed class-action lawsuit seeks damages over 2021 cyberattack on N.L. health-care system
Lawsuit, which still has to be certified, names provincial government and health authority as defendants
A proposed class-action lawsuit has been filed over the fall 2021 cyberattack on Newfoundland and Labrador's health-care system.
The attack, carried out by cyberthieves affiliated with the Hive ransomware group, stole both personal medical information as well as employee information from thousands of people.
The Office of the Information and Privacy Commissioner called it the largest hack of its kind in the province, and one of the largest in Canada to date. A report released in May from the office found that security deficiencies were known well before the cyberattack took place and were not corrected by officials.
Lawyers Bob Buckingham and Eli Baker filed a statement of claim at the Supreme Court of Newfoundland and Labrador on Nov. 9 on behalf of two plaintiffs, Fred Harnum and Allison George.
The defendants are listed as Newfoundland and Labrador Health Services and the provincial Department of Health and Community Services.
"People have been terrified about this. People have heard about breaches of privacy in the past, but in this particular case personal, private medical information has been stolen," Buckingham told CBC News.
"Nefarious people" were behind the attack, he said, and people have been left to wonder how their information might be misused, including to create fake identities.
"And we don't know, in this particular case, if the government has, you know, paid a ransom on this or if they have any guarantees that the information is not going to be used. People are very worried," he said.
Buckingham said his firm has been contacted by several people who were affected by the breach.
He pointed to "historical systemic negligence on the part of the government and the Health Services, and also a breach of confidence in terms of how they handled the information."
"But in particular, the government and health services have known for at least 12 years that there have been deficiencies and how they've been recording information and protecting it," he said.
As a result, he added, there was a cyberattack and people have suffered because of it.
Once the class-action lawsuit is certified, he said, the two lead plaintiffs will represent all of the people impacted by the cyberattack.
N.L. Health Services spokesperson Mikaela Etchegary and Department of Health and Community Services spokesperson Tina Coffey both declined to comment, as the matter is before the courts.
Seeking damages
Buckingham and Baker are also seeking damages, and while the statement of claim didn't give a figure, Buckingham said the amount "could be significant," as much as housands of dollars for each person.
"How that's going to work out is going to be an interesting question in terms of whether people get that money or we negotiate some sort of remedy that is appropriate in the circumstances. But it's substantial given the level of the negligence," said Buckingham.
He added a message has to be sent to the provincial government, and other governments, that they need to protect people's personal information.
According to a Office of the Information and Privacy Commissioner report released in May, an estimated 106,311 people were impacted by the attack.
When asked how many people could see a financial return if the lawsuit is successful, Buckingham said, "Look, there's just so many that they have been able to totally quantify, but in essence, perhaps almost everyone in the province."
Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Click here to visit our landing page.
ABOUT THE AUTHOR
