Canadians could be able to cash in on $35-million Capital One settlement

Canadians affected by a Capital One data breach could soon be eligible to claim compensation after a proposed class-action settlement was reached.

On July 16, Charney Lawyers announced that Capital One Financial Corporation, Capital One Bank (USA), National Association, and Capital One Bank (Canada Branch) have agreed to a $35-million settlement to resolve the class-action lawsuit related to a 2019 data breach that affected customers in Canada. The company issues credit cards for its banking business as well as for Costco and Hudson's Bay Company.

The settlement still has to be approved by the court.

The allegations

The lawsuit against Capital One was launched following a data breach in 2019, in which a hacker gained unauthorized access to applicants' and cardholders' personal information.

According to a court document, the company stores information in a database on Amazon Web Services, a third-party cloud-based server in the United States. In the spring of 2019, American software engineer Paige Thompson hacked Capital One's database, downloading personal and financial information belonging to millions of U.S. and Canadian residents who had applied for Capital One credit cards.

The breach, which impacted six million Canadians, was discovered by an independent security researcher in July 2019, who contacted law enforcement, resulting in Thompson's arrest by the FBI on July 29, 2019. Capital One published a notice about the data breach the same day.

Data stolen from Canadians included personal details submitted on credit card applications between 2005 and 2019. Stolen data included names, addresses, and contact information, as well as financial information such as annual income, status of mortgage, banking information, credit scores, credit limits, balances, payment history, and some transaction histories. Around one million Social Insurance Numbers (SIN) were compromised.

The class action alleges that Capital One failed to protect customers' personal information adequately, resulting in breaches of privacy, contract obligations, and consumer protection laws.

The class action's website states, "Capital One does not admit and denies any wrongdoing or liability."

Are you eligible?

You could be eligible to file a claim if you are a Canadian resident outside Quebec who applied for or held a Capital One credit card and received a letter stating that your personal information may have been affected by the data breach.

How much could you receive?

If you're eligible, the amount you receive depends on your type of claim. You could receive compensation if you fit into the following categories:

• Category A claims for out-of-pocket costs: You could be reimbursed for out-of-pocket costs as a result of the data breach if you spent money on preventative measures such as credit monitoring services, insurance, or credit freezes. You may also be reimbursed for losses related to identity theft, falsified tax returns, or other alleged wrongdoing. Each member in this category can claim up to a maximum of $25,000.
• Category B claims for wasted time and inconvenience: For affected class members whose SIN was not compromised but who spent time responding to the data breach, they can claim $25 per hour for up to five hours, to a maximum of $125. Canadians whose SIN was compromised can claim up to eight hours to a maximum of $200. Those who submit valid claims in this category will receive an additional $75 "top-up" payment, bringing the maximum payment under both sections to $200 for those whose SIN was not compromised, and $275 for those whose SIN was compromised.
• Category C claims for annual credit card fees: All annual fee class members will receive up to $50 when they submit a valid claim.

What should you do next?

For now, you don't need to do anything.

If the court approves the settlement, eligible class members will be able to submit a claim once the claims process opens. The approval hearing is scheduled for Sept. 22, 2026. Visit the class action's website for details.

Canadians could also be eligible for other class-action lawsuits, including those involving StubHub and Uber.