Proposed class action lawsuit launched against CRA over data breaches

Proposed class action lawsuit launched against CRA over data breaches | Insurance Business

Proposed class action lawsuit launched against CRA over data breaches

A proposed class action has been filed against the Canada Revenue Agency (CRA), accusing both the agency and the federal government of negligence and breach of privacy over the recent data breach incidents that rocked the revenue service.

The lawsuit was filed August 24, 2020 in Federal Court in Vancouver, CBC News reported. If given approval, the lawsuit will seek financial compensation for all victims to cover damage to credit ratings, costs for credit monitoring, and for mental distress.

It is alleged in the lawsuit that several “failings” by the government and the CRA allowed at least three cyberattacks to take place – they occurred from mid-March to mid-August. But news of the attack was not publicly disclosed until CBC News broke the story in August.

Read more: Two massive cyberattacks hit CRA, prompt online service closure

The lawsuit further alleges that due to the delay in detecting the breaches, the number of victims whose data was compromised grew to at least 14,500.

“The actions of the [CRA] are reprehensible,” the claim stated. “and showed a callous disregard for the rights of [victims].”

In addition, the lawsuit purported that the CRA’s conduct was “a deliberate ... departure from ordinary standards of decent behaviour, and as such merits punishment.”

CRA announced that it was “a vulnerability in security software” that led to the online breaches, and that it was not aware of the first cyberattack until August 07.

CBC News reported that both the CRA and the federal government have yet to file a response to the lawsuit.