The cost of litigating to suppress details could be less than the cost of LifeLabs potential exposure to a class action suit because of what could potentially b

The cost of litigating to suppress details could be less than the cost of LifeLabs potential exposure to a class action suit because of what could potentially be construed as negligence in their IT security practices. They're not just psycho jerks for fighting it, it could just be part of their fiduciary duty. The risk to them is, IMO, the standard of security and privacy governance within the public sector is much higher than pretty much any other institution I've seen, so in comparison, showing that a private company did not meet that standard would be trivial. However, the question of what kind of diligence was done on the original contract (or not) could blow up, since every mandatory risk assessment (if completed) done on it would have raised this breach possibility and recommended controls to mitigate it. I was livid when I read about the breach as it's precisely the kind of incident every single security and privacy analyst who has ever advised the public service has used as a baseline scenario. It fell out of the news cycle I think because it was so bad it crossed the line into discrediting institutions, which isn't done in mainstream Canada. The party in power whose minister approved this contract has been out of power for 3+ years, so politically for them it's just wastewater under the bridge, but as a legacy, this breach was in the realm of worst case scenario. For the sake of popular trust in the health system in general, the root cause analysis should be seen through.