CPA Canada Class Action Lawsuit Claims Hundreds of Thousands of Customers’ Data Exposed in Breach

An Alberta man claims that lax data security at a national accounting organization, Chartered Professional Accountants of Canada (CPA Canada), led to the exposure of his and thousands of other consumers’ personal information.

CPA Canada Data Breach

Lead plaintiff, Christopher Yee of Canmore, Alberta, claims that CPA Canada was hacked between Nov. 30, 2019 and May 1, 2020. According to Yee’s class action lawsuit, the hackers potentially accessed his name, address, email, employer’s name and his job title, along with his CPA membership number, type, and status. The complaint says that, in addition to Yee, nearly 330,000 CPA Canada customers were affected by the data breach.

According to the complaint, CPA Canada was formed in 2013. It combined over 40 national and provincial accounting groups and reported revenues of nearly $130 million in 2019. The group provides services to Chartered accountants, including CPA Magazine.

“CPA Canada reports that the personal information that was obtained by an unauthorized third party mainly related to the distribution of its magazine and included names, home addresses, and email addresses,” says the complaint.

Negligent Data Security Led to Breach, Says Plaintiff

The plaintiff contends that CPA Canada had a duty of care to protect his and other customers’ personal information. He accuses CPA Canada of failing to implement security measures that are standard in the industry to protect the data the company had collected.

In addition to failing to provide adequate data security measures, the plaintiff says that CPA Canada took far too long to notify him and others whose information was compromised about the data breach.

“Despite the data breaches occurring since November 30, 2019, the Defendant did not notify the Plaintiff until June 3, 2020,” points out the class action lawsuit.

CPA Canada’s failure to notify customers that their information had been compromised allegedly left them unknowingly vulnerable to identity theft and fraud for months.

The plaintiff says that he and other CPA Canada customers would not have made purchases or signed on to receive CPA Magazine had they known that the company would not implement adequate data security measures.

Data Breach Compromises Professionals’ Clients

Yee says that he and many others affected by the breach are professionals and the information compromised includes their clients’ information. The CPA Canada class action lawsuit alleges that these clients may be subject to fraudulent business emails and other cyberattacks, as a result of the breach.

“It is expected that these types of attacks will continue for years,” states the complaint.

Class Members Under Threat of Identity Theft, Fraud

The class action lawsuit seeks to represent a proposed class of individuals whose personal information was exposed in the CPA Canada data breach. The plaintiff says that he and other Class Members may be subjected to the illegal use of their data that was exposed to hackers.

“The Personal Information, when in the hands of a third party is capable of being used in a variety of illegal ways including identity theft, credit card fraud, email fraud, ransomware attacks, phishing attacks and theft,” alleges the class action lawsuit Canada.

Indeed, Yee claims that he had to change all of his passwords, over 200, after being informed of the CPA Canada data breach, from his CPA password to his credit cards and bank accounts. Yee says the process was a burden – inconvenient and time-consuming. In addition, he says that he and other Class Members will need to purchase extra credit monitoring and identity theft insurance to protect themselves from future use of personal information compromised in the data breach.

The class action lawsuit accuses CPA Canada of negligence, unjust enrichment, and breach of contract, along with violations of various provincial consumer protection laws and Canada’s Competition Act.

The plaintiff is seeking $21 million in damages for himself and on behalf of the proposed Class Members, including costs related to remedial measures they have and will have to take in the future. The plaintiff contends that CPA Canada should be forced to give up revenue obtained from proposed Class Members who believed the organization would protect their information when they signed on with the company.

The class action lawsuit is also seeking a court order requiring CPA Canada to provide proposed Class Members with credit monitoring services.

Are you a CPA Canada customer? Were you affected by the CPA Canada data breach? Tell us what happened in the comment section below!

The lead plaintiff, Christopher Yee, and proposed Class Members are represented by Clint Docken of Guardian Law Group LLP and James Brown of James H. Brown & Associates.

The CPA Canada Data Breach Class Action Lawsuit is Yee v. Chartered Professional Accountants of Canada, Case No. 2001-11809, in the Court of Queen’s Bench of Alberta, Canada. 

Read More Lawsuit & Settlement News:

• WestJet Class Action Lawsuit Takes Flight Over Travel Credits
• Overdraft Fees Amount to Criminal Interest, Class Action Lawsuit Alleges
• Canadian Bank and Credit Union Overdraft & NSF Fee Lawsuit
• Pandemic Business Interruption Insurance Canada Potential Lawsuit