Supreme Court of British Columbia Partially Certifies Class-Action Lawsuit in Mackenzie Financial, InvestorCOM Data Breach
The Supreme Court of British Columbia has partially certified a class-action lawsuit against Mackenzie Financial Corp. and InvestorCOM Inc., following a 2023 data breach that exposed private investor data. The ruling, issued on June 19, allows claims under provincial privacy legislation to proceed in B.C., while other allegations including negligence, breach of contract, and fiduciary duty remain under the existing certified action in Ontario.
The breach originated when cybercriminals exploited a software vulnerability in InvestorCOM’s systems, potentially compromising data linked to Mackenzie clients. In response, proposed class actions were filed in both Ontario and B.C. Last year, Ontario’s court certified the case as a multi-jurisdictional proceeding but excluded claims under provincial privacy laws. Both the companies and the plaintiffs have since appealed aspects of that decision, with hearings yet to be scheduled.
In its ruling, the B.C. court determined that certifying only the privacy-related claims in the province would streamline proceedings, avoid conflicting judgments, and respect jurisdictional interests. The decision also dismissed claims for Québec residents and limited compensation to costs tied to future harm prevention, excluding damages for emotional distress. Punitive damages were also deemed unwarranted.
No allegations in the case have been proven in court. The legal proceedings continue in both provinces, with the Ontario action addressing broader claims and B.C. focusing solely on privacy violations.
Source: https://www.investmentexecutive.com/news/regulation/b-c-allows-data-breach-class-action/
InvestorCOM Inc. TPRM report: https://www.rankiteo.com/company/investorcominc
Mackenzie Financial Corp. TPRM report: https://www.rankiteo.com/company/mackenzie-investments
"id": "macinv1782427767",
"linkid": "mackenzie-investments, investorcominc",
"type": "Vulnerability",
"date": "1/2023",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Investors',
'industry': 'Finance',
'location': 'Canada',
'name': 'Mackenzie Financial Corp.',
'type': 'Financial Services'},
{'customers_affected': 'Mackenzie clients',
'industry': 'Technology/FinTech',
'location': 'Canada',
'name': 'InvestorCOM Inc.',
'type': 'Software Provider'}],
'attack_vector': 'Software Vulnerability',
'data_breach': {'personally_identifiable_information': 'Potentially',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Private investor data'},
'date_detected': '2023',
'description': 'The Supreme Court of British Columbia has partially certified '
'a class-action lawsuit against Mackenzie Financial Corp. and '
'InvestorCOM Inc. following a 2023 data breach that exposed '
'private investor data. The breach originated when '
'cybercriminals exploited a software vulnerability in '
'InvestorCOM’s systems, potentially compromising data linked '
'to Mackenzie clients.',
'impact': {'data_compromised': 'Private investor data',
'legal_liabilities': 'Class-action lawsuit',
'systems_affected': 'InvestorCOM’s systems'},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'root_causes': 'Software vulnerability in '
'InvestorCOM’s systems'},
'references': [{'date_accessed': '2024-06-19',
'source': 'Supreme Court of British Columbia Ruling'}],
'regulatory_compliance': {'legal_actions': 'Class-action lawsuit',
'regulations_violated': 'Provincial privacy '
'legislation (B.C.)'},
'threat_actor': 'Cybercriminals',
'title': 'Mackenzie Financial and InvestorCOM Data Breach Class-Action '
'Lawsuit',
'type': 'Data Breach',
'vulnerability_exploited': 'Software Vulnerability in InvestorCOM’s systems'}