Settlement Of Walmart Canada Photo Centre Data Breach Lawsuits – Lessons Learned

Canadian class action lawsuits over the Walmart Canada Photo Centre data breach were settled in May 2017. The lawsuits and settlement provide useful lessons for Canadian organizations that collect and process sensitive customer information.

The Data Breach

The Walmart Canada Photo Centre website, operated by Vancouver-based service provider PNI Digital Media ("PNI"), was the victim of a cyber-attack that installed malware on PNI's data centre servers to collect customers' credit card data and other personal information (e.g. names, emails and account passwords). After learning of the incident, Walmart Canada suspended the Photo Centre website, notified the Office of the Privacy Commissioner of Canada, engaged an independent consultant to conduct an investigation of the incident, and notified potentially affected customers.