In the matter of Bourbonnière v. Yahoo!
Inc.1, the Quebec Superior Court applied the
principles laid down by the Quebec Court of Appeal in the
Sofio2 decision and confirmed that being a
victim of an IT security incident does not in and of itself give
rise to a claim for damages by the victim.
1. Overview of the facts
Following Yahoo!'s disclosure in 2016 that personal and
financial information in the user accounts of 500 million of its
subscribers had been stolen by hackers, Ms. Bourbonnière
sought authorization to bring a class action on behalf of all
persons in Quebec who were potential victims of data theft due to
this successful cyber-attack against Yahoo!'s platforms.
Her proceeding alleged psychological and emotional distress,
potential financial losses from the hackers' unauthorized
access to Yahoo! user accounts, and annoyance and inconvenience
resulting from the sending of spam from her email address to her
acquaintances.
