Proposed class-action lawsuit seeks damages over 2021 cyberattack on N.L. health-care system

A proposed class-action lawsuit has been filed over the fall 2021cyberattack on Newfoundland and Labrador's health-care system.

The attack, carried out by cyberthieves affiliated with the Hive ransomwaregroup, stole both personal medical information as well as employee information from thousands of people.

The Office of the Information and Privacy Commissioner called it the largest hack of its kind in the province, and one of the largest in Canada to date. A report released in May from the office found that security deficiencies were known well before the cyberattacktook place and were not corrected by officials.

Lawyers Bob Buckingham and Eli Baker filed a statement of claim at the Supreme Court of Newfoundland and Labrador on Nov. 9 on behalf of two plaintiffs, Fred Harnum and Allison George.

The defendants are listed asNewfoundland and Labrador Health Services and the provincial Department of Health and Community Services.

"People have been terrified about this. People have heard about breaches of privacy in the past, but in this particular case personal, private medical information has been stolen," Buckingham told CBC News.

"Nefarious people" were behind the attack, he said, and people have been left to wonder how their information might be misused, including to create fake identities.

"And we don't know, in this particular case, if the government has, you know, paid a ransom on this or if they have any guarantees that the information is not going to be used. People are very worried," he said.

Buckingham said his firm has been contacted by several people who were affected by the breach.

WATCH I Lawyer Bob Buckingham outlines why people are suing after the 2021 health data cyberattack:

Lawsuit filed after 2021 cyberattack crippled N.L.s health-care system, affected private data of thousands

10 months ago

Duration 1:35

Lawyer Bob Buckingham said he is representing two lead plaintiffs in a lawsuit he hopes will be certified as a class action against the Newfoundland and Labrador government and health authority following the cyberattack that saw the ransomware group Hive access the private medical data of more than one out of every 10 people in the province.

He pointed to "historical systemic negligence on the part of the government and the Health Services, and also a breach of confidence in terms of how they handled the information."

"But in particular, the government and health services have known for at least 12 years that there have been deficiencies and how they've been recording information and protecting it," he said.

As a result, he added, there was a cyberattack and people have suffered because of it.

Once the class-action lawsuit is certified, he said, the two lead plaintiffs will represent all of the people impacted by the cyberattack.

N.L. Health Services spokesperson Mikaela Etchegary and Department of Health and Community Services spokesperson Tina Coffey both declined to comment, as the matter is before the courts.

Seeking damages

Buckingham and Baker are also seeking damages, and while the statement of claim didn't give a figure, Buckingham said the amount "could be significant," as much as housands of dollars for each person.

"How that's going to work out is going to be an interesting question in terms of whether people get that money or we negotiate some sort of remedy that is appropriate in the circumstances.But it's substantial given the level of the negligence," said Buckingham.

He added a message has to be sent to the provincial government, and other governments, that they need to protect people's personal information.

According to aOffice of the Information and Privacy Commissionerreport released in May, an estimated 106,311 people were impacted by the attack.

When asked how many people could see a financial return if the lawsuit is successful, Buckingham said, "Look, there's just so many that they have been able to totally quantify, but in essence, perhaps almost everyone in the province."

Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Click here to visit our landing page.