Court File and Parties

Court File No.: CV-20-647324-00CP Date: 20211116 Superior Court of Justice - Ontario

Re: Arthur Redublo and Donna Moher And: 8262900 Canada Inc. o/a Carepartners

Before: J.T. Akbarali J.

Counsel: Cary Schneider, Tina Q. Yang, Adam Warner, Margaret Waddell and Christine Sesek, for the plaintiffs Adam Soliman and Carlos Sayao, for the defendant

Heard: November 16, 2021

Endorsement

Overview

[1] The parties to this putative class proceeding have reached a settlement agreement, subject to approval of the court. On this motion, they seek approval of their notice plan to provide notice to the class of the settlement, and the hearing date for the planned motion to certify the action on consent for the purposes of settlement, for settlement approval, and for approval of counsel’s fees.

Background

[2] This class proceeding relates to a cyber-breach of the defendant’s computer systems, confirmed by the defendant in June 2018. An unknown amount of data was exfiltrated from the defendant’s computer system.

[3] The defendant was able to confirm that 908 living patients and 886 employees (many of whom are unionized and not in the proposed class as a result) had their data exfiltrated in the hack, because data relating to those individuals were attached to the hacker’s email notifying the defendant of the breach. A ransom demand made by the hackers went unpaid.

[4] The hackers then delivered a sample of the exfiltrated data to the CBC, which reported on the hack. According to the media report, the data contain names and contact information for more than 80,000 patients, plus detailed medical histories, and were a subset of hundreds of thousands of patient records and related material dating back to 2010. The sample was also reported to include employee information.

[5] The CBC has declined to confirm how many individuals were included in the sample set it received from the hackers, although it has agreed to allow an independent reviewer to review the records it received to locate any information that identifies or could lead to the identification of class members if and when the settlement is approved.

The Notice Plan

[6] As I have noted, at this stage, approval is sought for the notice plan to notify the class of the motion for consent certification, settlement approval, and approval of class counsel’s fees.

[7] The notice plan provides for direct notice of the motion to be provided to individuals who were identified by the defendant through the data attached to the email it received from the hackers, as well as direct notice by email to any putative class members for whom the defendant has a readily available email address, or who have contacted class counsel. The defendant will also email the notice to all the non-unionized employees and contractors it employed between January 1, 2010 and June 11, 2018. This portion of the plan exhausts all avenues for direct notice available to the parties at this time, given that the CBC will not make available the data in its possession until settlement is approved, if it is.

[8] The notice plan provides for indirect notice in the form of a press release, which is expected to be picked up by online newspapers, and may receive additional press coverage given the media interest in the hack at the outset. It also provides for social media postings by counsel on Twitter and LinkedIn, and public postings on the defendant’s and class counsel’s websites.

[9] I am satisfied that this indirect notice plan is appropriate. It avoids the costs of newspaper advertising, but through the press release, will largely accomplish the goal of having the notice distributed in online newspapers. It maximizes the breadth of the notice while minimizing the costs of the notice. Since the settlement agreement provides for the cost of the notice program to come out of the settlement fund, the notice plan thus maximizes the proceeds of settlement for the class.

[10] Moreover, if settlement is approved, there will be an opportunity to identify other class members through the results of the independent review of the data in CBC’s possession. This will allow for notice of the settlement approval to be delivered directly to a greater number of potential class members, who will then have the option to opt out of the settlement.

[11] In these circumstances, I approve the notice plan, and the notice, with one amendment. The notice shall indicate provide the zoom link for the hearing. The court shall schedule the zoom attendance forthwith so as to allow the parties the ability to release the notice with the zoom link in it.

[12] Order to go as per the draft I have amended as per para. 11 above, and signed. For counsel’s reference, amendments are highlighted and are limited to the draft notice.

[13] The motion for consent certification, settlement approval, and approval of counsel’s fees shall proceed on February 9, 2022 at 10 a.m. for one half day.

J.T. Akbarali J.

Date: November 16, 2021