It’s not just the price of gasoline that has been the talk of the town in recent days in the province. On July 7, 2023, the firm LPC Avocats filed a national class action in the Superior Court of Quebec against Petro-Canada because of a data leak that occurred on June 21 targeting Canadian customers. The duration of the incident is unclear, so it is possible that it took place over several days in the country. The management of the company is then singled out by the complainants who demand compensation.
According to documents presented to the court, this class action concerns “all persons in Canada whose personal or financial information held by Petro-Canada was compromised during the cybersecurity incident that occurred on or around June 21, 2023 or after , or who have received notification from Petro-Canada advising them of this Cyber Security Incident. »
What happened on June 21 at Petro-Canada?
On June 26, 2023, Petro-Canada informed its customers that it had experienced a cybersecurity incident on https://twitter.com/petrocanada/status/1673356475224444929.
“Petro-Canada is a Suncor business and together we respond to a cyber security incident. Although our establishments are open, you may experience interruptions to certain services. At this time, some of our locations are cash-only and logging into our app and Petro-Points is not available. Car washes may also not be available at certain locations,” they warned.
Then the https://twitter.com/petrocanada/status/1674372140382973958, it was stated in the update regarding this incident that Petro-Canada locations have reopened and debit and credit transactions are once again possible at most locations, in addition to payments in cash. However, the application, the Petro-Points program and some car washes remained unavailable.
On July 6, so more than ten days after the incident, the company finally revealed more information about this data leak.
“Based on our investigation to date, we have determined that an unauthorized party gained access to our IT network on or around June 21, 2023 and that our Petro-Points program was impacted. The unauthorized party obtained the basic contact information of the members. As a precaution, we have disabled our Petro-Points systems, including our app and website, and are conducting increased security monitoring,” the firm announced on the same social network.
The company then revealed that the points redemption feature had been disabled, but the customer balance remained intact. As compensation, a credit will be offered for the points accumulated during the interruption.
Note that when talking about members’ basic contact information, it is specified that it is the full name, email, email or postal address, or even the date of birth.
It is also recommended to be particularly vigilant to emails or other unusual messages that you may receive in the near future if you are concerned. You should confirm any request to pair, download or invite to a call.
“The security of your personal information is important to us. We regret this incident has occurred and thank you for your patience and understanding as we seek to resolve the situation,” the company added.
It should be noted that because of these interruptions, several branches only accepted cash.
Who is affected by the class action?
The document provided to Narcity states that this class action is for “all individuals in Canada whose personal or financial information held by Petro-Canada was compromised during the ‘cybersecurity incident’ which occurred on or about on or after June 21, 2023, or who have received notification from Petro-Canada informing them of this Cyber Security Incident. »
Customers must also have a Petro-Points account with a valid email address, a linked RBC payment card or have recently exchanged money.
What does collective action demand?
The class action seeks damages for disturbances and inconvenience to customers.
“Defendants did not offer any credit monitoring or refund policy insurance amounts to class members. […] Defendants were negligent and at fault in this regard since they failed to activate TransUnion and Equifax services for their Canadian customers, and many class members are not even aware of the data breach.
“By choosing not to automatically activate credit monitoring from both credit agencies and not posting appropriate fraud alerts to all members of the group (which could have been done quickly via email, text or notification on their apps for smartphones), the defendants clearly chose to save money instead of helping to protect class members. Indeed, there are paid fees for TransUnion and Equifax Canada to activate credit monitoring services and/or to issue a fraud alert, but the defendants do not offer this and have not paid to automatically activate these services. services,” is stated in the class action.
The exact amount allocated will be determined later, if this class action receives authorization from the Court to go to court and hear the merits of the dispute.
What are the next steps?
For now, the class action has been filed, it must now be authorized by the Court of Quebec. Thereafter, the court will rule on a judgment or an amicable settlement agreement between the two parties, which must be authorized by the court. It is following this entire process that the population concerned will be able to receive compensation.
This data leak is national, so it concerns several provinces.
Note that inclusive writing is used for writing our articles. To learn more on the subject, you can consult the Government of Canada page.
