Canadian Consumers Allegedly Left in The Dark After Drive DeVilbiss Data Breach

Data breaches and cyberattacks in Canada have gone up this year. The average cost of data breaches in Canada reportedly rose 6.7% since 2019. Indeed, a recent string of cyberattacks have affected Canadians in numerous ways. Not only have these attacks placed Canadians’ private information, including health information, at risk, but they have even slowed COVID-19 testing in certain regions. The latest class action lawsuit to be launched in Canada over a massive data breach was filed against Drive DeVilbiss, a medical equipment manufacturer and distributor.

If you purchased mobility products, beds, wheelchairs, respiratory equipment, self-assist products, long-term care and rehabilitation products, or other devices from Drive DeVilbiss, your personal data may have been breached by hackers.

Drive DeVilbiss Data Breach

Drive DeVilbiss is an American company that manufactures and distributes medical equipment directly to their clients, and indirectly through third party medical companies.

According to the data breach class action lawsuit against Drive DeVilbiss, in September of this year, Drive DeVilbiss advised their Canadian clients that an unauthorized party had gained access to and acquired possession of consumers’ personal information. The hacked information includes, among other data, customer names, medical diagnosis information, medical condition information, other medical and/or health insurance information, social security numbers, bank account numbers and tax identification numbers.

The data breach class action lawsuit argues that the cyberattack violated Class Members’ privacy rights and reasonable expectations.

Drive DeVilbiss has not publicly identified the cybercriminals. Furthermore, the class action lawsuit submits that the basis of Drive DeVilbiss’ public assurance that the unnamed cybercriminals only “briefly possessed the Class Members’ Personal Information” has never been explained to consumers, nor guaranteed.

Medical Data of Thousands Hacked

The data breach class action lawsuit against Drive DeVilbiss claims that the company’s “extensive access, receipt, collection, use, storage, transfer or transmission of the Personal Information made it foreseeable to Drive DeVilbiss that its electronic databases are a prime target for criminal activity including attempts to hack and steal the Personal Information.”

Indeed, health data falls under the category of sensitive personal information, requiring utmost protection and care. As such, Drive DeVilbiss had an obligation to protect user information from unauthorized access by third parties, asserts the complaint.

These allegations against Drive DeVilbiss are based on legislative requirements set out in the provincial Personal Information Protection Act and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Relevant privacy legislation compels organizations holding personal information to implement physical, organizational and technological safeguards or control procedures to prevent loss, theft and unauthorized access, collection, use, disclosure, copying, modification or disposal of personal information, something Drive DeVilbiss allegedly failed to do.

Additionally, Drive DeVilbiss is accused of failing to hire competent employees, properly supervising employees, or providing proper training to employees, all of which contributed to the 2020 data breach.

Drive DeVilbiss Withholds Information From Canadian Consumers

According to the data breach class action lawsuit against Drive DeVilbiss, the defendant failed to immediately notify Class Members that their personal information had been left unprotected and subjected to loss, theft, unauthorized access, collection, use, disclosure, copying, modification or disposal, following the data breach. “Drive DeVilbiss made this choice to delay disclosure to Canadian customers wilfully and deliberately, despite notifying American customers and authorities earlier than Canadians,” the complaint points out.

As a result of the data breach,  Canadian consumers allegedly suffered loss and damages including but not limited to:

• Violation of privacy;
• Psychological distress;
• Costs incurred in preventing identity theft;
• Costs incurred in paying for credit monitoring services; and
• Out-of-pocket expenses.

Drive DeVilbiss customers may also be subjected to the possibility of exposure to future false marketing by cybercriminals fictitiously holding themselves out as third party organizations with which the Class Members truly and properly have a relationship. This may subject Class Members to further identity and information theft in the future, according to the data breach class action lawsuit.

On Nov. 17, the Canadian government published a news release announcing the Minister of Innovation, Science and Industry’s introduction of the proposed Digital Charter Implementation Act, 2020. The Act aims to modernize the framework for the protection of personal information in the private sector. The proposed law is to include the strongest fines among G7 countries for privacy laws—with fines of up to 5% of revenue or $25 million, whichever is greater, for the most serious offences.

Has your private information ever been hacked on the internet? Share your story with us in the comments below!

Proposed Class Members are represented by Slater Vecchio LLP and Mathew P Good Law Corp.

The Drive DeVilbiss Data Breach Class Action Lawsuit is Janet Symmonds v. Medical Depot inc d.b.a. Drive DeVilbiss Healthcare, Case No. S2011681, Before the Supreme Court of British Columbia, Canada.

Read More Class Action Lawsuit & Settlement News:

• Microsoft Software Class Action Settlement
• Pandemic Business Interruption Insurance Canada Potential Lawsuit
• Long-Term Disability Lawyer | Insurance Claim Denial Help
• Hershey’s Chocolate Uses Child Labour And Slavery, Class Action Lawsuit Alleges