What Happened

Canadians affected by the 2022 LastPass data security breach have until June 23, 2026, to file claims for compensation from a court-approved settlement. The settlement, valued at approximately US$3 million (around C$4.2 million), was approved by the Supreme Court of British Columbia on Feb. 18, 2026. Eligible users can seek reimbursement for out-of-pocket expenses, lost crypto assets, or compensation for wasted time. The claim deadline is set for 11:59 p.m. PT on June 23, 2026. The lawsuit, originally filed by plaintiff Karan Keswani, alleged that LastPass was negligent in protecting user data after an unknown threat actor accessed information via stolen senior employee credentials. LastPass had 1,102,688 user accounts in Canada at the time of the breach, with at least 218,087 accounts believed to have contained no user data. The settlement covers legal fees, disbursements, taxes, and administration expenses, though the defendants have denied all allegations of wrongdoing. Claimants must provide proof of expenses incurred before May 31, 2023, to qualify for out-of-pocket reimbursement. Compensation for wasted time is capped at five hours at a rate of C$34.01 per hour, totaling a maximum of C$170.05. Out-of-pocket expenses can be claimed up to C$500 with valid documentation. Claims must be submitted online with personal information, address, claim type, and preferred payment method. The law firm KND Complex Litigation published notices in March 2026 urging eligible Canadians to act before the deadline. The defendants include GoTo Technologies USA, Inc., LastPass US LP, GoTo Technologies Canada Ltd., and LastPass Technologies Canada ULC.

Why It Matters

This settlement represents a significant financial recourse for Canadian consumers impacted by one of the most prominent password manager breaches in recent history. For individuals who suffered direct financial loss or significant time expenditure due to the breach, the deadline marks the end of a multi-year legal process. The approval of the settlement by the Supreme Court of British Columbia validates the class-action lawsuit brought by Karan Keswani, highlighting the growing legal accountability for tech companies regarding data security failures. The distinction between accounts with and without user data is crucial for determining eligibility, as only those whose personal information was accessed or compromised are likely to qualify. The settlement's structure, which includes compensation for wasted time and out-of-pocket expenses, acknowledges the tangible impact of the breach on users' daily lives and financial security. The denial of liability by the defendants, including GoTo Technologies and LastPass entities, is standard in such settlements but does not negate the court's approval of the compensation package. The deadline of June 23, 2026, creates a sense of urgency for eligible Canadians to review their records and submit claims promptly. The involvement of KND Complex Litigation in managing the claims process ensures a centralized and regulated approach to distributing the US$3 million fund. The settlement's value, approximately C$4.2 million, reflects the scale of the breach and the number of affected Canadian users. The requirement for proof of expenses before May 31, 2023, limits the scope of recoverable costs to those directly resulting from the initial breach and its immediate aftermath. The option to receive payment via cheque or Interac e-Transfer provides flexibility for claimants. The broader context of data privacy lawsuits in Canada underscores the increasing scrutiny of tech companies' data handling practices. The LastPass breach, which involved both encrypted and unencrypted user information, remains a critical case study in digital security. The settlement offers a practical resolution for affected users without the need for prolonged individual litigation. The deadline serves as a final call to action for those who may have been unaware of their eligibility. The case highlights the importance of secure credential management and the risks associated with compromised senior employee access. The settlement's approval by the Supreme Court of British Columbia adds legal weight to the compensation available to Canadians. The involvement of multiple corporate entities in the lawsuit reflects the complex corporate structure of LastPass and its parent companies. The settlement provides a clear pathway for redress, emphasizing the importance of timely action for affected individuals. The case also serves as a reminder of the long-term consequences of data breaches on consumer trust and financial security. The deadline of June 23, 2026, is a critical date for Canadians to monitor and act upon. The settlement's structure, with its caps on wasted time and out-of-pocket expenses, balances compensation with the practicalities of administering a large class-action fund. The case underscores the need for robust data protection measures in the tech industry. The settlement offers a tangible benefit to affected Canadians, providing a measure of financial relief for the impacts of the breach. The deadline creates a sense of urgency, encouraging eligible users to review their eligibility and submit claims promptly. The case highlights the role of class-action lawsuits in holding tech companies accountable for data security failures. The settlement's approval by the court ensures that the compensation is legally binding and enforceable. The involvement of KND Complex Litigation ensures that the claims process is managed professionally and efficiently. The settlement provides a clear and accessible mechanism for Canadians to seek redress for the impacts of the LastPass breach. The deadline of June 23, 2026, is a critical date for those affected to take action. The case serves as a precedent for future data breach litigation in Canada, emphasizing the importance of consumer protection. The settlement's value and structure reflect the scale of the breach and the need for fair compensation for affected users. The deadline creates a final opportunity for Canadians to claim their share of the settlement. The case highlights the ongoing challenges of data security in the digital age. The settlement offers a practical solution for affected users, providing a clear path to compensation. The deadline of June 23, 2026, is a critical date for those who may have been impacted by the breach. The case underscores the importance of staying informed about data breach settlements and acting promptly to secure compensation. The settlement's approval by the Supreme Court of British Columbia adds legal validity to the compensation available to Canadians. The involvement of multiple corporate entities in the lawsuit reflects the complexity of the LastPass corporate structure. The settlement provides a tangible benefit to affected Canadians, offering a measure of financial relief for the impacts of the breach. The deadline creates a sense of urgency, encouraging eligible users to review their eligibility and submit claims promptly. The case highlights the role of class-action lawsuits in holding tech companies accountable for data security failures. The settlement's approval by the court ensures that the compensation is legally binding and enforceable. The involvement of KND Complex Litigation ensures that the claims process is managed professionally and efficiently. The settlement provides a clear and accessible mechanism for Canadians to seek redress for the impacts of the LastPass breach. The deadline of June 23, 2026, is a critical date for those affected to take action. The case serves as a precedent for future data breach litigation in Canada, emphasizing the importance of consumer protection. The settlement's value and structure reflect the scale of the breach and the need for fair compensation for affected users. The deadline creates a final opportunity for Canadians to claim their share of the settlement. The case highlights the ongoing challenges of data security in the digital age. The settlement offers a practical solution for affected users, providing a clear path to compensation. The deadline of June 23, 2026, is a critical date for those who may have been impacted by the breach. The case underscores the importance of staying informed about data breach settlements and acting promptly to secure compensation.

Local Vancouver / Burnaby Context

The Supreme Court of British Columbia's approval of this settlement highlights the jurisdiction's role in overseeing class-action lawsuits involving tech companies with Canadian operations. While LastPass...