Proposed class action lawsuit claims data breach exposed personal information of 258,000 people

A Vancouver software engineer has launched a proposed class action lawsuit in the wake of an alleged data breach involving personal information belonging to former customers of bankrupt computer retailer NCIX.

In anotice of civil claim filed in B.C. Supreme Court, Kipling Warner says he gave the company his name and address along with his debit and credit card details in the course of purchasing computer products.

He's seeking to certify a lawsuit against NCIXand the company tasked withauctioning off the computer firm's old equipment.

Warner claims NCIXfailed to properly encrypt the information of at least 258,000 people. And he claims the auctioneer failed to take "appropriate steps to protect the private information on its premises."

His lawyer, David Klein, told CBCthat customers dealing with a technology company would expect anyone who comes into contact with their information to take steps to ensure confidentiality.

"Not only did they fail to take steps to protect the privacy," he said. "It looks like some of the lists may have been sold to criminals who will exploit the credit card information and very likely engage in identity theft of NCIXcustomers."

A man named 'Jeff'

NCIXwas a B.C.-based online computer hardware and software retailer.

The company, officially known as NetlinkComputer Inc., had retail outlets in the Lower Mainland as well as Markham, Mississauga, Scarborough and Ottawa before filingfor bankruptcy last year.

The lawsuit followsquestions which began circulating last week with a post on cybersecuritywebsite PrivacyFly.

The author, Travis Doering, said he arranged to meet a man named 'Jeff' who claimed on Craigslist to be selling old NCIX hardware.

Doeringsaid 'Jeff' offered information from offline backup servers on millions of transactions. He claimed to have seen detailed financial information about customers and the personal tax details of former NCIXemployees.

Richmond RCMPopened an investigation into the alleged data breach last Friday as a result of those allegations.

'Private information was storedunsecured'

According to the proposed class action lawsuit, a trustee was appointed to take possession and make an inventory of all NCIX'sproperty last December.

The court documents claim NCIXcollected and retained "more information than was necessary and for longer than necessary concerning its customers" while it was a going concern.

Warner says NCIXfailed to encrypt and secure the information before handing control of its business to the trustee.

The lawsuit claims the trustee contracted the auctioneer to dispose of the property including servers from NCIX'sestate through a series of sales, which were open to the public.

"During the sales, private information was storedunsecured on (the auction company's) premises," the lawsuit reads.

"Members of the public were able to see, manipulate and take away the private information or copies of it."

'Wasted time, frustration and anxiety'

Warner is suing NCIX and the auction company for negligence and alleged breaches of both B.C.'s Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

He says customers had no notice their private information was being either sold or transferred. And he claimsboth the trustee and the auctioneer should have had comprehensive policies in place to protect data.

The provincial privacyact says organizations doing business in British Columbia have a duty to protect the personal information entrusted to them.

The federal regulation says personal information that is "no longer required to fulfil the identified purposes should be destroyed, erased or made anonymous."

The proposed class action lawsuit says millions of customers could be affected.

Warner is suing for loss including damage to credit reputation, mental distress, "wasted time, frustration and anxiety" and time lost "engaging in precautionary communication" with banks, credit agencies and credit card companies.

"It is a massive data breach," said Klein. "There's no total amount that's stipulated in the claim. Everyone who was a customer will have to take steps to ensure their credit card information isn't stolen. There is the cost, the inconvenience and the worry."

The trustee for NCIXdid not return calls for comment.

A representative for the auctioneer told CBCthe company had only just learned of the lawsuit and was consulting with lawyers.

None of the allegations have been proven in court.

With files from Belle Puri and Joan Marshall