B.C. Judge Certifies Class Action Over TransLink Ransomware Breach

Summary

A B.C. judge certified a class action covering 38,958 people whose personal data TransLink confirmed was accessed in a 2020 ransomware incident. Whether TransLink violated its duty to safeguard the data remains for trial.

Key points

• The judge certified a class proceeding covering 38,958 people whose personal information TransLink said had been accessed; liability and damages remain for trial.
• TransLink discovered the network intrusion on Dec. 1, 2020. The ruling says ransomware was inserted after a successful phishing attempt targeting an employee of a subsidiary.
• By June 2021, TransLink’s investigation had confirmed that cybercriminals accessed files and folders containing sensitive information.
• The information included social insurance and bank account numbers, payroll records, addresses, dates of birth, WorkSafe reports and scanned cheques.
• The judge held that access under B.C.’s Privacy Act does not necessarily require proof that a person viewed or downloaded the data; whether TransLink breached its safeguarding obligations remains to be decided.
• A cybersecurity expert involved in the case testified that TransLink had foundational deficiencies, including inadequate threat monitoring, lack of data encryption and insufficient executive oversight.
• The judge found class proceedings preferable and ruled that credit monitoring and identity-theft protection did not by themselves resolve the claims.

MITRE ATT&CK

People