Bank of Montreal (BMO) Data Breach $21.2M Class Action Settlement

The Bank of Montreal (BMO) agreed to pay $21.2 million to resolve claims it failed to protect customer data in a 2018 data breach.

The settlement benefits BMO clients whose personal information was compromised during the 2018 data breach. Class Members are split into the following groups:

• Group 1: BMO clients whose personal information (date of birth, SIN, etc.) was posted online
• Group 2: BMO clients whose date of birth and SIN were accessed by unauthorized individuals
• Group 3: BMO clients whose personal information other than birth dates or SINs were accessed by unauthorized individuals
• Group 4: BMO clients who had unauthorized charges on their account due to the data breach

The Bank of Montreal (BMO) is the 8th largest bank in North America, serving over 12 million customers. This includes customers in both Canada and the United States.

In May 2018, BMO announced it was the target in a massive ransomware data breach. Up to 50,000 clients had their information stolen by hackers who demanded $1 million from the banks as ransom. If the bank failed to pay up, the hackers threatened to sell sensitive consumer information to “criminals” online.

Although the bank promised immediate action to mitigate the issue and beef up security, BMO customers still faced fraud and identity theft risks as a result of the data breach. According to CBC, one Edmonton man faced a fraudulent transfer of $980 while personal information from an Ontario man and British Columbia woman were posted along with the hackers’ letter.

Some BMO customers took legal action against the bank, arguing it failed to take reasonable steps to protect their information. As a result of this alleged negligence, tens of thousands of customers had their information stolen, the plaintiffs alleged.

BMO hasn’t admitted any wrongdoing but agreed to a $21.2 million settlement to resolve the allegations. This settlement includes a fixed fund of nearly $12.8 million and a claimable fund of nearly $8.5 million.

Under the terms of the settlement, Class Members can collect cash payments from each fund based on which group they fall under. 

The fixed fund provides cash payments based on group membership and the amount of time spent mitigating consequences from the data incident. 

Class Members in Group 1 can automatically receive a $1,000 payment from the fixed fund to compensate them for 20 hours of time. 

Class Members in Group 2 can automatically receive a $144 payment from the fixed fund to compensate them for eight hours of time. 

Class Members in Group 4 can automatically receive a $270 payment from the fixed fund to compensate them for 15 hours of time.

The claimable fund will be used for Class Members who want to file a claim for additional payments. Groups 1 and 2 can claim up to three and a half additional hours at $18 per hour, for an additional payment of $63. 

Group 3 Class Members will not receive a payment from either fund without filing a claim. However, if they file a claim by the claim deadline, they can claim up to five hours at $18/hour, for a total payment of $90.

The settlement has already been approved by provincial courts in Canada. No exception or objection date is applicable for this settlement.

Some settlement benefits will be automatically sent to Class Members in the form of a mailed check. 

In order to receive additional benefits from the settlement, Class Members may need submit a valid claim form by April 11, 2022.

Who’s Eligible

The settlement benefits BMO clients whose personal information was compromised during the 2018 data breach. Class Members are split into the following groups:

• Group 1: BMO clients whose personal information (date of birth, SIN, etc.) was posted online
• Group 2: BMO clients whose date of birth and SIN were accessed by unauthorized individuals
• Group 3: BMO clients whose personal information other than birth dates or SINs were accessed by unauthorized individuals
• Group 4: BMO clients who had unauthorized charges on their account due to the data breach

Potential Award

Varies

Proof of Purchase

No proof of purchase applicable.

Claim Form

NOTE: If you do not qualify for this settlement do NOT file a claim.

Remember: you are submitting your claim under penalty of perjury. You are also harming other eligible Class Members by submitting a fraudulent claim. If you’re unsure if you qualify, please read the FAQ section of the Settlement Administrator’s website to ensure you meet all standards (Top Class Actions is not a Settlement Administrator). If you don’t qualify for this settlement, check out our database of other open class action settlements you may be eligible for.

Claim Form Deadline

04/11/2022

Case Name

Mallette v Bank of Montreal, File No. CV-18-00076745-00CP, in the Ontario Superior Court of Justice

Final Hearing

10/03/2020

Settlement Website

BMOSettlement.ca

Claims Administrator

Epiq Class Action Services Canada Inc.
Attention: BMO Data Incident Class Action Settlement Claims Administrator
P.O. Box 507 STN B
Ottawa ON K1P 5P6
[email protected]
833-683-5861

Class Counsel

SISKINDS LLP

SOTOS LLP

JSS BARRISTERS

SISKINDS DESMEULES

Defense Counsel

MCCARTHY TÉTRAULT LLP