Deadline nears for Canadians to claim up to $500 in $4M data breach settlement
Canadians could receive up to hundreds of dollars from a class-action lawsuit settlement, but the deadline to file a claim is quickly approaching.
Eligible Canadians affected by the LastPass data security breach can submit a claim for a share of a court-approved settlement of US$3 million (around C$4.14 million). LastPass is a cloud-based password manager that stores usernames, passwords, and other sensitive information. In a notice published in March, law firm KND Complex Litigation urged eligible class members to file a claim for compensation.
Canadians have until June 23, 2026, to submit a claim.
The lawsuit
Piotr Swat/Shutterstock
A court document states that LastPass was targeted by “an unknown threat actor” in 2022, who gained access using credentials stolen from a senior employee and obtained users’ encrypted and unencrypted information.
When the breach occurred, LastPass had 1,102,688 user accounts in Canada, though at least 218,087 of these are believed to have contained no user data.
Plaintiff Karan Keswani brought forward a class-action lawsuit against the company on behalf of affected Canadians. It was filed in the Supreme Court of British Columbia against GoTo Technologies USA, Inc., LastPass US LP, GoTo Technologies Canada Ltd., and LastPass Technologies Canada ULC.
The lawsuit alleges that LastPass was negligent and failed to take appropriate measures to protect users’ personal information from cyber threats. It claims the company didn’t adequately investigate or communicate the full scope and impact of the data breach.
A settlement of US$3 million was approved on Feb. 18 and is expected to cover all legal fees, disbursements, taxes, and administration expenses.
KND Complex Litigation notes that the settlement is “not an admission of liability, wrongdoing, or fault on the part of the Defendants, all of whom have denied, and continue to deny, the allegations against them.”
Are you eligible?
LastPass
You could be eligible for compensation if you live in Canada, and your personal information was accessed by unauthorized parties in the 2022 LastPass data breach.
There are three types of claims that you can file for:
- Wasted time — compensation for up to five hours of time wasted as a result of the data breach. Eligible Canadians can receive C$34.01 per hour, for a total of C$170.05.
- Out-of-pocket expenses — you could get reimbursed for related expenses of up to C$500. You must be able to provide proof of expenses incurred before May 31, 2023.
- Crypto claims — Canadians can file a claim for crypto assets that were allegedly lost due to the data breach.
How can you file a claim?
Canadians who meet the eligibility requirements must fill out a claim form online no later than 11:59 p.m. PT on June 23.
If you meet the eligibility criteria, you’ll need to provide your personal information, address, the type of claims you qualify for, supporting documents where applicable, and your preferred method of payment (cheque or Interac e-Transfer).
Visit the LastPass class action website for more information.
Canadians could also qualify for claims in a data breach class action lawsuit against the Canada Revenue Agency (CRA).