Cathay Pacific Data Breach $1.55M Class Action Settlement

Cathay Pacific agreed to a $1.55 million class action settlement to resolve claims it failed to protect remote customers in a 2018 data breach.

The settlement benefits Canadian individuals whose information was jeopardized in the data breach revealed by Cathay Pacific on Oct. 24, 2018.

In October 2018, Cathay Pacific — a Hong Kong-based airline — revealed its servers had been accessed by hackers. This breach occurred in at least early 2018 and compromised phone numbers, birth dates, passport and ID numbers, air travel data, and credit card numbers.

A British Columbia resident filed a class action lawsuit against Cathay Pacific Airways in 2019, alleging they and 9.4 million other passengers had their personal information stolen in a data breach due to the airline’s negligence.

According to the plaintiff, Cathay Pacific knew of the risks associated with cyber security but negligently failed to take reasonable actions to protect its passengers. Instead, the company allegedly allowed “commonly-known and exploitable vulnerabilities” to remain on its servers — allowing hackers to gain access.

Specifically, Cathay Pacific allegedly failed to implement multifactor authentication for remote users and stored unencrypted backup files. Both of these factors allowed hackers to access sensitive information, the Cathay Pacific class action lawsuit contends.

In addition, the plaintiff alleges Cathay Pacific failed to promptly inform him and other affected passengers of the data breach. 

Instead, the company allegedly waited seven months to inform the public. 

According to the Cathay Pacific class action lawsuit, this valuable time could have been used to protect private information and defend against fraud.

Cathay Pacific hasn’t admitted any wrongdoing but agreed to resolve these allegations with a $1.55 million settlement deal.

Under the terms of the settlement, Class Members can recover reimbursement for any out-of-pocket losses or expenses that resulted from the data breach. This may include credit monitoring or identity theft protection purchased by Class Members or expenses incurred as a result of fraudulent activity. 

No payment estimates are available.

The deadline for exclusion and objection in the settlement was April 23, 2021. 

The final approval hearing for the settlement was held July 12, 2021.

In order to receive benefits from the settlement, Class Members must submit a valid claim form by Aug. 31, 2022.

Who’s Eligible

The settlement benefits Canadian individuals whose information was jeopardized in the data breach revealed by Cathay Pacific on Oct. 24, 2018.

Potential Award

Varies

Proof of Purchase

Proof of Class Membership consisting of EITHER the original notification email from Cathay Pacific in October 2018, or the court-approved notice email in March 2020.

Claim Form

NOTE: If you do not qualify for this settlement do NOT file a claim.

Remember: you are submitting your claim under penalty of perjury. You are also harming other eligible Class Members by submitting a fraudulent claim. If you’re unsure if you qualify, please read the FAQ section of the Settlement Administrator’s website to ensure you meet all standards (Top Class Actions is not a Settlement Administrator). If you don’t qualify for this settlement, check out our database of other open class action settlements you may be eligible for.

Claim Form Deadline

08/31/2022

Case Name

James Rodney McLean v. Cathay Pacific Airways Limited, Case No. S-199228, in the Supreme Court of British Columbia

Final Hearing

07/12/2021

Settlement Website

CXDataIncident.ca

Claims Administrator

Hammerco Lawyers LLP
1220 – 1200 West 73rd Avenue
Airport Square
Vancouver, BC V6P 6G5
Attention: Alexia Majidi
cxdataincident@hammerco.ca
888-693-4226

Class Counsel

HAMMERCO LAWYERS LLP

MATHEW P GOOD LAW CORPORATION

EVOLINK LAW GROUP

Defense Counsel

BLAKE CASSELS & GRAYDON LLP