Class-action lawsuit filed in BC over 2009 Interior Health data breach

British Columbia's Interior Health Authority has been hit with a class-action lawsuit over a data breach in 2009 that allegedly compromised thousands of employees' personal information that ended up being sold on the dark web.

The lawsuit filed in B.C. Supreme Court on Thursday says the data breach occurred in December 2009, exposing "highly sensitive" personal information belonging to people who worked for the health authority between 2003 and 2009.

Court documents say the information was accessed by "cybercriminals and other malicious actors," and the "full extent" of the hack still hasn't been disclosed by Interior Health in the 16 years since.

Former employee Rae Fergus, one of the lead plaintiffs, says her personal information has been used since 2022 to fraudulently get a car loan and a credit card, and to open a bank account without her "knowledge or consent."

Susan Shaw, another proposed representative plaintiff who worked for the health authority, says in the lawsuits that she only found out about the data breach last month by reading a news article, and was allegedly offered two years of free credit monitoring after contacting Interior Health about it.

The lawsuit says police in Port Coquitlam, Surrey, and Vernon since 2017 have discovered documents containing Interior Health employee personal information, leading to the health authority publishing a notice online about the hack in March 2024, the "first public acknowledgment" of the breach.