Former employees apply for class-action lawsuit against Interior Health over stolen identities

Two former employees have filed an application for a class action lawsuit against Interior Health in the B.C. Supreme Court.

The lawsuit, filed May 22, alleges the employer was reckless and tried to conceal the full extent of the data breach that resulted in the personal information of thousands of employees being stolen and then sold on the dark web.

As a result, it says, those affected didn't have the opportunity to fully protect themselves — and they are still living with the consequences.

"The effects of this data breach have been life-altering," said Justin Giovannetti, the lawyer representing the two former employees. "Identities have been stolen, used to commit fraud."

The lawsuit has yet to be certified, and none of the allegations have been proven in court.

CBC News contacted Interior Health for a response earlier this week and was told it was not aware of the lawsuit. No response has been filed in court.

Thousands impacted

The breach occurred in or around December 2009, the lawsuit states, affecting employees who worked for Interior Health between 2003 and 2009.

But it says, even as of May 2025, the full extent of what happened has yet to be shared.

LISTEN | The Fifth Estate host Mark Kelley on the investigation: 

Daybreak South8:31The Fifth Estate investigation: B.C. health-care workers hacked following data breach

Investigative reporter Harvey Cashore explains how a massive data breach of Interior Health employees’ private identification led to impostors hacking into several health-care workers’ CRA accounts. 

One of the employees in the suit, Rae Fergus, says they only became aware of the breach after being informed of it by a former colleague.

The other, Susan Shaw, says she learned about it on April 15, 2025, after reading about it in a news article. She says she then contacted Interior Health and was told she had been affected.

April 15 is the day a CBC The Fifth Estate investigation revealed that more than 28,000 people who had worked for Interior Health had been impacted by the breach, with personal information including social insurance numbers, birth dates and home addresses being posted online, for sale on the dark web.

Victims identified by The Fifth Estate were victims of fraud, ranging from having bogus tax returns filed in their name to one who was listed as the sole director of two federally registered shell companies.

The plaintiffs in the case say they have had fraudulent car loans and credit card applications taken out in their name, and describe the stress of trying to clean it up.

The suit also alleges that throughout, Interior Health failed to proactively disclose the full extent of the breach, including its seriousness, both publicly and to affected employees, calling it "fraudulent concealment."

Interior Health offering credit monitoring

Following media reports of the breach in April, Interior Health put out a public statement outlining the steps it had taken to reach the affected employees.

It said it learned of the potential breach in January 2025 after getting information from the RCMP that an employee's personal information had been stolen.

In March, it put out a news release asking anyone who worked for them between 2003 and 2009 to contact a toll-free number to determine if they had been affected based on the documentation provided by the RCMP.

The statement said that while Interior Health was working to contact all current employees directly, it was unable to do so for former employees because it no longer had their contact information.

It also said it was offering two years of credit monitoring to anyone affected.

Lawsuit needs certification to move forward

Giovanetti says part of the hope of the lawsuit is to extend the credit monitoring due to the possibility of the leaked information impacting individuals for years to come.

If the lawsuit is certified, people affected by the breach will have an opportunity to opt out but will otherwise be represented in the case.

He encouraged anyone who worked for the health authority between 2003 and 2009 to check if they had been affected by the breach and, if they had, to take steps to protect themselves.

"This is 28,000 individuals who may have been impacted for the last 15 years," he said. "There's a financial toll on people, but there's also a mental toll."