LifeLabs to Pay Out $4.9 Million for Data Breach if Court Approves Class Action Settlement

A lab technologist tests a specimen for COVID-19 in Surrey, B.C., in a file photo. The Canadian Press/Darryl Dyck

Customers of LifeLabs prior to Dec. 17, 2019, may be eligible for a cash settlement from a class action lawsuit, the laboratory company announced on Aug. 10.

LifeLabs, based in Toronto, provides lab testing services to Canadians in Ontario, British Columbia, and Saskatchewan. It is one of Canada’s largest providers of medical laboratory testing, according to court documents. It carries out more than 100 million lab tests from about 20 million patient visits each year and employs 5,700 employees.

The company disclosed a data breach in December 2019 and a class action lawsuit arising out of that breach was certified, meaning approved, by the Ontario Superior Court of Justice.

The online health portal operated by the lab has more than 2.3 million patients accessing their test results each year, and the bulk of the lab’s revenue is publicly funded, court documents indicate.

According to LifeLabs, the court will be asked to approve the settlement on Oct. 25, 2023. Customers will have the choice to stay in the class action lawsuit and participate in the settlement, stay in the class action lawsuit and object to the settlement, or opt out of the class action and receive no benefits from any approved settlement.

KPMG LLP, an audit, tax, and advisory firm, provided details of the data breach, describing it as an “attack by a criminal cyber-attacker” on LifeLabs’ database of customer personal health information. An action was brought by three representative plaintiffs alleging negligence in the company’s protection of customer data. LifeLabs denied the allegations.

The plaintiffs alleged the company didn’t have adequate and effective cybersecurity in place. In one case, it was alleged a patient affected by the breach was not notified until some two months after LifeLabs first reported the security breach to the offices of the Ontario, B.C., and other provincial privacy commissioners.

KPMG said the class action lawsuit includes approximately 8.6 million individuals had their personal information stolen, including their provincial health card numbers. Another approximately 131,957 patients of the lab had confidential test requisitions or test results stolen by hackers, who then demanded a ransom.

“LifeLabs paid a ransom and the cyber-attackers returned the data. That data has not been identified as being sold on the dark web or otherwise misused by anyone,” said KPMG.

The company negotiated a settlement with the plaintiffs and the court will hold a hearing on Oct. 25 by video conference to consider approving the proposed settlement.

LifeLabs, according to the settlement agreement, provided affected individuals “complementary credit monitoring and identify theft insurance” at the expense of the company for a one-year period.

The company would not be admitting any liability, unlawful conduct, or negligence under the terms of the settlement. Individuals whose data was compromised and who have a valid claim could receive from $50 to $150 if the proposed $4.9 million settlement receives court approval.

Those who will receive a portion of the settlement would receive it by e-transfer or cheque, according to the agreement.