Class action against Yahoo! for cyberattacks refused by Quebec Superior Court

A judge refused to give the green light to a class action to convict Yahoo! for cyber attacks that have compromised the confidentiality of its users’ data.

Judge Chantal Tremblay of the Superior Court did not authorize this action.

The facts giving rise to this dispute are as follows: in September 2016, Yahoo! issued a statement announcing that nearly 500 million of its users were victims of a cyberattack dating back to 2014 and that their data would have been stolen. In December 2016, the company informed its users of another cyber attack that took place in 2013.

In February 2017, users are informed that the use of falsified cookies would have allowed a third party to access the information contained in their account between 2015 and 2016.

Stolen information includes usernames, email addresses, phone numbers, birth dates, encrypted passwords and, in some cases, security questions and answers, whether encrypted or unencrypted.

As a result, a class action application was filed in Quebec in 2017.

The one who wanted to be representative of the group of victims for this action, Brigitte Bourbonnière, has an e-mail account with Yahoo !. She wanted all people whose personal or financial information was stolen from Yahoo! during cyberattacks.

She blames Yahoo! Inc. and Yahoo Canada to have been negligent and to not have adequately protected his personal data.

She argues that anyone whose data has been stolen has experienced inconvenience, distress and economic loss. She also claimed punitive damages.

In her case, her account was hacked, but she does not know what information was stolen. She fears a theft of her identity and is afraid of being defrauded because of the possible sale of her information on the black market and their use by criminals. She was also embarrassed, since some of her friends would have received junk mail on her behalf, trying to extort money from them, it is summarized in the judgment.

For the Superior Court, it is not enough

Madam Justice Tremblay relies on Ms. Bourbonnière’s testimony that she has no reason to believe that she was the victim of identity theft or fraud: she saw nothing suspicious in her accounts. In addition, the judge notes that she continues to use her Yahoo! and admits that they have not purchased identity protection services such as credit monitoring.

In short, the only harm she would have suffered was having to change her passwords, and the inconvenience of having to explain to her friends that they were receiving extortion e-mails.

To pass this stage of the authorization of a class action, Ms. Bourbonnière should have demonstrated that the alleged facts appear to justify the conclusions sought. The Court must distinguish factual allegations from arguments, opinions, inferences and unsubstantiated hypotheses, as well as implausible or false assertions, explains Me Myriam Brixi, a lawyer specializing in collective action practicing in the Montreal law firm Lavery De Billy and who was interested in this judgment.

“You have to demonstrate compensable harm. And to reach compensable damage, we must go beyond the simple annoyance, “she explained in an interview.

And in the specific case of this case, there were contradictions between the written allegations in the court proceedings and Ms. Bourbonnière’s answers during her interrogation, added the lawyer.

In some cases, victims of data theft have paid for protection of their financial records and this could constitute compensable damage. But this was not the case of Ms. Bourbonnière.

“A compensable damage must be” serious and prolonged “and go beyond the ordinary inconveniences, anxieties and fears that a person living in society can experience,” writes Judge Tremblay, refusing to authorize the action.

The case law on data theft is becoming more and more extensive, says Brixi. “Recourse for breach of data protection has increased exponentially in recent years. Cybercrime has become the second most common type of financial fraud, “she wrote in a recent news bulletin from her firm.

You May Also Like

Leave a Reply

Your email address will not be published. Required fields are marked *