Canadians can get up to $500 from new multimillion-dollar settlement

The settlement in a class-action lawsuit against LastPass, a password manager, has been approved, and Canadians could receive a payout.

KND Complex Litigation says eligible Canadians can now file a claim to receive part of the court-approved class-action settlement of US$3 million (around C$4.13 million).

On Wednesday, the law firm published a notice stating that Canadian customers allegedly affected by the LastPass data security breach should file a claim before the deadline on June 23, 2026.

The lawsuit

According to a court document, in 2022, LastPass was the victim of "an unknown threat actor" who used credentials stolen from a senior employee and accessed users' encrypted and unencrypted information. At the time of the breach, there were 1,102,688 LastPass accounts for users in Canada; however, at least 218,087 are believed to have contained no user data.

A class-action lawsuit against LastPass was brought forward on behalf of affected Canadians by plaintiff Karan Keswani, seeking damages related to the data breach. The lawsuit, filed in the Supreme Court of British Columbia, names defendants GoTo Technologies USA, Inc., LastPass US LP, GoTo Technologies Canada Ltd., and LastPass Technologies Canada ULC.

It alleges that the company had been negligent and failed to take appropriate measures to protect users' private information from cyber threats. It also claims that LastPass did not adequately investigate and communicate the full scope and impact of the data breach.

On Feb. 18, the court approved the US$3-million settlement, which includes all legal fees, disbursements, taxes, and administration expenses.

"The Settlement is not an admission of liability, wrongdoing or fault on the part of the Defendants, all of whom have denied, and continue to deny, the allegations against them," reads the statement.

Are you eligible for the settlement?

You could be eligible to file a claim if you live in Canada and your personal information was accessed by unauthorized parties in the 2022 LastPass data breach.

Eligible Canadians can file for three types of claims:

• Wasted time — this includes compensation for up to five hours wasted due to the data breach. Those affected can receive C$34.01 per hour, for a total of C$170.05.
• Out-of-pocket expenses — you could get reimbursed for related expenses of up to C$500. You'll need to provide proof of expenses incurred before May 31, 2023.
• Crypto claims — Canadians can file a claim for alleged crypto asset losses related to the data breach.

How can you file a claim?

If you meet the eligibility requirements, make sure to fill out a claim form online before the June 23 deadline.

You'll need to provide your personal information, address, the type of claims you qualify for, supporting documents where applicable, and your preferred method of payment.

Visit the LastPass class action website for more information.