Quebec court approves $200.9M settlement against Desjardins over data breach

The Superior Court of Quebec has approved a nearly $200.9-million settlement of a class-action lawsuit against Desjardins over a data breach the largest to date in the Canadian financial services sector.

Siskinds Desmeules and Kugler Kandestin, the lawyers for the class members, say everyone affected by the breach, regardless of where they live, will be eligible to claim.

Class members may seek compensation for loss of time that is related to the personal information breach, as well as for identity theft.

In addition, class members who have not already registered for Equifax's credit monitoring service will be able to do so for five years at Desjardins' cost, and maintain the other protective measures implemented by Desjardins following the breach for at least five years.

The federal privacy commissioner said in 2020 that a series of technological and administrative gaps caused the high-profile data breach at the financial co-operative, which he said did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of 4.2 million people who had active accounts, Desjardins said.

Class members do not have to take any steps at this stage. Notices containing instructions for making claims will be distributed over several months beginning around July 21.

For at least 26 months, a rogue employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization.