LifeLabs data breach

On 17 December 2019, LifeLabs — Canada's largest provider of laboratory diagnostic testing — disclosed that cyber attackers had penetrated its systems and accessed the personal and health information of roughly 15 million customers, the overwhelming majority of them residents of Ontario and British Columbia. It remains one of the largest health-data breaches in Canadian history.

What happened

LifeLabs identified the unauthorized access on 28 October 2019 and notified the Ontario and B.C. privacy commissioners on 1 November. Rather than disclose immediately, the company spent several weeks working with outside cybersecurity and ransom-negotiation experts. It ultimately paid an undisclosed ransom to recover the data the attackers had extracted, before going public in mid-December.

The compromised systems held a sweeping set of fields: customer names, addresses, email addresses, login credentials and passwords, dates of birth, health-card numbers, and laboratory test results. For roughly 85,000 customers, lab results from 2016 or earlier were directly exposed. The identity of the attackers was never publicly established, and forensic firms reported no evidence the stolen data was later published or sold.

Regulatory findings

In June 2020, the Information and Privacy Commissioners of Ontario and British Columbia issued a joint investigation report concluding that LifeLabs had failed to take reasonable steps to safeguard personal health information, in violation of Ontario's Personal Health Information Protection Act and B.C.'s Personal Information Protection Act. The regulators found systemic shortcomings in LifeLabs' information-security posture.

LifeLabs fought for years to keep the report confidential, arguing portions were protected by solicitor-client privilege. It lost that battle, and the full report was published in November 2024 — more than four years after it was written — confirming the depth of the security failings.

Impact

• Roughly 15 million customers had personal and health data accessed, primarily in Ontario and B.C.
• LifeLabs paid a ransom of an undisclosed amount to retrieve the data.
• A class-action lawsuit was settled for up to CA$9.8 million; with high claim volumes, individual claimants ultimately received only a few dollars each.
• The company offered affected customers free credit monitoring and identity-theft protection.

Why it matters

The LifeLabs breach is a defining Canadian case study in the ethics and consequences of paying ransoms to protect sensitive health data, and in the limits of corporate transparency. The years-long fight to suppress the regulators' report — ultimately unsuccessful — reinforced the principle that organizations holding health data owe the public a full accounting when that trust is breached, and it informed subsequent debates over mandatory breach-disclosure timelines in Canadian privacy law.