Canadian LastPass password manager users who experienced a data breach in 2022 have only a few days left to file for a class-action lawsuit. Eligible users can receive up to $500 CAD. The final application deadline is June 23 (11:59 PM Pacific Time).
LastPass is a cloud-based password management service designed to store usernames, passwords, and sensitive information. In 2022, LastPass experienced a serious data security incident—hackers gained unauthorized access to the system by stealing senior employee accounts and obtaining encrypted and unencrypted data from some users. At the time, there were 1,102,688 LastPass accounts in Canada, although approximately 218,087 of these accounts did not contain user data. Details of the litigation and settlement proposal
Following the data breach, Canadian user Karan Keswani, representing those affected, filed a class-action lawsuit in the Supreme Court of British Columbia. The lawsuit targets four companies: GoTo Technologies USA, Inc., LastPass US LP, GoTo Technologies Canada Ltd., and LastPass Technologies Canada ULC, accusing LastPass of negligence in its security measures and failure to properly investigate and disclose the full details of the incident.
Ultimately, the two parties reached a settlement, with the court approving a US$3 million (approximately CAD$4.2 million) compensation package to cover all legal fees, taxes, and administrative expenses. The law firm KND Complex Litigation pointed out that this settlement does not represent a guilty plea or admission of negligence—they denied all charges from the outset and maintain that position.
LastPass data breach class-action lawsuit involves many Canadian users.
Who can apply? The compensation is divided into three categories.
If you reside in Canada and your personal information was compromised in the 2022 LastPass data breach, you can file a claim. Compensation is divided into three categories: Time loss: You can claim up to 5 hours of time lost in response to the data breach, with compensation of $34.01 per hour, up to a maximum of $170.05.
Out-of-pocket expenses: Up to $500 can be reimbursed for additional losses incurred due to the data breach (such as the purchase of security software, credit monitoring, etc.), but relevant expense receipts must be provided for expenses incurred before May 31, 2023.
Cryptocurrency losses: Claims can also be made if crypto assets are stolen or lost due to data breaches.
How to apply?
Eligible users must complete the online form on the LastPass class action website by 11:59 p.m. (Pacific Time) on June 23, submitting personal information, address, claim type, and required supporting documents, and select a payment method (cheque or Interac e-Transfer). For detailed procedures and frequently asked questions, please refer to the official application website: https://lastpasscanadiansettlement.ca/en In addition, the filing deadline for the class-action lawsuit against the genealogy website 23andMe is approaching, and affected Canadian users should pay attention to relevant announcements.