Class action lawsuit filed in B.C. court over LifeLabs data breach

Vancouver — Another class action lawsuit has been filed over the massive cyberattack that targeted the laboratory testing company LifeLabs, this time in B.C. Supreme Court.

The proposed class action was filed by Collette Parsons Corrin LLP on behalf of Anna Belle Tharani, a B.C. care aide who was among the millions of Canadians whose personal information was potentially compromised in the data breach.

Tharani's lawsuit argues that LifeLabs lacked "adequate security" and "adequate training for employees" ahead of the attack, and that the company should have notified customers sooner after it happened.

LifeLabs notified B.C.'s Information and Privacy Commissioner about the breach on Nov. 1, but the public was not made aware until mid-December.

That delay potentially exposed customers to "additional, unnecessary risks of harm," according to the claim.

LifeLabs has not filed a statement of defence in the case, and has not responded to a request for comment from CTV News. None of the claims in Tharani's lawsuit have been proven.

B.C. Health Minister Adrian Dix previously said the company requested some time before making the breach public because it wanted to first ensure its systems were secure and not vulnerable to secondary attacks.

"There was a delay to ensure that information that hadn't been compromised wouldn't be compromised and information that could be protected was protected," Dix told reporters earlier this month.

The cyberattack affected systems containing information on about 15 million customers across Canada, including up to five million in B.C. The criminals responsible demanded a ransom, which the company paid in the hopes of retrieving the data.

LifeLabs CEO Charles Brown offered an apology to customers in the wake of the attack, and said the company brought in cybersecurity experts to investigate what happened and help restore security.

"I want to emphasize that at this time, our cyber security firms have advised that the risk to our customers in connection with this cyber-attack is low and that they have not seen any public disclosure of customer data as part of their investigations, including monitoring of the dark web and other online locations," Brown said in a statement.

At least one other class action lawsuit has been proposed against LifeLabs in Ontario Superior Court.