Martin Knuth has made so many purchases at Home Depot that he regards the store as "my second home."
But the recent security breach at the home renovation retailer upset Mr. Knuth, a retiree who lives in Regina, Sask., so much that he volunteered to become the representative plaintiff in the first Canadian class action lawsuit against Home Depot.
The suit has been launched on behalf of all Canadian customers of retailer Home Depot Inc. who may have had their credit and debit cards hacked.
Saskatchewan lawyer Tony Merchant – a long-time class-action activist – said he filed the claim on behalf of as many as four million Canadians who have been affected. Home Depot customers could get hit with financial losses and inconvenience, Mr. Merchant said.
The suit, filed in the Court of Queen's Bench for Saskatchewan, will also be filed in other jurisdictions and will cover all Canadian customers, Mr. Merchant said.
In early September, Home Depot acknowledged that its payment system was hit by a security breach, affecting customers in Canada and the United States who used credit and debit cards from April onward. The company said no customer would be responsible for any fraudulent charges on their accounts, and promised it would take aggressive steps to protect customer data going forward.
The suit alleges Mr. Knuth's "personal and financial information associated with his credit card was compromised. …as a result of the Home Depot security breach," although when contacted Thursday he said he doesn't know yet whether it has been used for nefarious purposes. But he has used his card at Home Depot many times since April, and he is worried about identity theft, unauthorized charges, or that "some day I may do a credit check on myself and find that it's gone down the toilet."
Mr. Merchant said he does not think he will have any trouble getting the class action suit certified in Canada. "The courts are very open to these privacy breach claims," he said. The amount of the claim has not yet been set.
Several class action lawsuits have already been filed in the United States on behalf of Home Depot customers. Home Depot spokeswoman Paula Drake said the company hasn't reviewed any of the suits against it yet. "Our focus is on our customers and our investigation," she said. Home Depot said Thursday that the "unique, custom-built malware" that hit its computer systems and put 56 million payment cards at risk has now been eliminated. Enhanced encryption has been completed at U.S. stores and will be in Canadian stores by early 2015.
The Canadian lawsuit alleges Home Depot breached its fiduciary duty to keep personal data confidential, and was negligent in allowing the breach. The company also waited too long to warn customers of the problem, the suit alleges.
"They weren't telling people until [security blogger] Brian Krebs broke the story at the beginning of September," Mr. Merchant said. "An awful lot of people have spent [money] at Home Depot in the last six months, and every one of them is at risk."
He noted that in an earlier case against the owners of Winners and HomeSense stores – after a similar data breach – an out-of-court settlement included a payment to all customers as a "worry award." It also paid back people who had actually suffered financial losses, and reimbursed those who spent money to get extra security for their cards.
Home Depot has offered free identity theft protection and credit monitoring to any customer who used a payment card at a store since April, but Mr. Merchant said "what they are offering ... is almost nothing and very little in value."
Some Canadian customers have also complained that the protection offered in this country is inferior to that offered in the United States. For example, the identity theft insurance in the package offered to Canadians – from credit bureau Equifax – has an upper limit of $50,000. In the United States the insurance in the package from AllClear covers up to $1-million.
Ms. Drake said the $50,000 maximum is the "best available coverage offered by the [credit] bureaus in Canada." There are "regulatory and market differences," between the two countries that account for the contrast, she said.
Raymond Vankrimpen, head of the risk management practice at Richter Advisory Group Inc. in Toronto, noted that a portion of the $1-million in coverage available to U.S. residents goes to cover legal fees. "Americans are typically more litigious and so the cost of recovering your identity in the U.S. may in fact cost more," he said.