Important Update

The settlement was approved by the Court on May 28, 2024.

More information on how settlement funds will be distributed can be found below.

Agromart & Sollio AG Privacy Breach Class Action

Court:
Ontario Superior Court of Justice

Class Members:
This class action is brought against Agromart and Sollio AG on behalf of all Canadians whose personal information was collected and stored on the computer system in the control of the defendants, and that was compromised or accessed in the Breach.

Co-counsel:
Foreman & Company is working with Waddell Phillips Professional Corporation on this matter.

The content of this page has not been approved by the Court nor does it constitute legal advice. It is for the purpose of providing general information only.

Case Contacts

Jon Foreman

Anni Barry

Sarah Bowden

Foreman & Company, together with Waddell Phillips Professional Corporation, launched a class action in relation to a cyber-attack on the computer systems of Agronomy Company of Canada Ltd (“Agromart”) and its parent company Sollio Agriculture LP (“Sollio AG”, together with Agromart, the “Defendants”) that occurred on or about May 27, 2020 (the “Breach”).

Important Update

The Settlement Agreement

A settlement has been reached whereby the Defendants have agreed to pay $500,000, all inclusive, from which a cash compensation and the funding of a 5 year credit monitoring and identity theft protection plan will be provided to eligible class members.

The settlement is not an admission of liability by the Defendants, rather it is a negotiated compromise of both parties’ positions.

The settlement was approved by the Court on May 28, 2024 and resolves this action in its entirety. At the same time the Court also approved the payment of Class Counsels’ legal fees, disbursements, settlement administration expenses and tax, which will be paid from the settlement amount.

A copy of the Court’s orders for settlement approval and fee approval can be found below.

Who is included in the Settlement

The settlement was approved by the Court to include:

all persons residing in Canada, whose Personal Information was stored on the computer systems of the Defendant’s that were potentially compromised or accessed in the Breach, excluding senior executives, officers, directors and managers of the Defendants, to whom the Defendants previously provided notice of the Breach and who are alive as of the date of the Settlement Approval Order; and Class Member means any one thereof

Opting Out

Class members had the right to exclude themselves from the class action and settlement by opting out. The deadline to opt out was July 17, 2024. There will be no further opportunity to opt out.

Distribution of Settlement Funds

The Court has approved a “Distribution Protocol” which governs how the settlement funds will be distributed among class members. The Distribution Protocol can be viewed in the Document section below.

There is no requirement to file a claims form.

Class members will be provided with access to a 5 year credit monitoring and identity theft protection plan paid for from the settlement fund. In addition, it is anticipated that each class member will receive a payment of approximately $100 - $150 as cash compensation. These amounts are estimates only, and the amount of cash that each class member will ultimately receive will depend on variables that include the total number of class members participating, and the total cost of the settlement administration process.

Cheques and credit monitoring activation information will be distributed to class members by mail. Please ensure that you notify the Claims Administrator (RicePoint Administration Inc., 1-888-726-1789 or agromartclassaction@ricepoint.com) if your mailing address needs to be updated.

More information regarding the timing for the distribution of settlement cheques and credit monitoring will be posted once available.

Case Overview

The claim alleges that hackers were able to penetrate Agromart and Sollio AG’s systems due to substandard cybersecurity systems. The hackers then extracted the confidential and sensitive personal information of thousands of Canadian farmers and made it accessible to malevolent actors on the dark web. The claim alleges that the amount of personal information that the Defendants acquired from their customers, and carelessly stored, exceeds the amount of information that was reasonably necessary for their operations.

The claim alleges that Agromart and Sollio AG were negligent, invaded the class members’ privacy, and committed various statutory breaches, and seeks damage for the affected class members.

The Cyber Breach

Agromart and their partner Sollio AG are agricultural inputs retailers that sell supplies to farmers across eastern Canada. Sollio AG and Agromart allegedly collected and stored excessive amounts of their customers’ sensitive personal and financial information as a requirement for the provision of their services.

REvil, also known as Sodinokibi (the “Hackers”), have claimed responsibility for the Breach. They are a well-known hacker group infamous for targeting vulnerable computer systems, extracting personal information, holding this sensitive data hostage, and demanding large ransom payouts for its safe return. If companies do not pay, the data is then auctioned off on the dark web.

The plaintiff alleges that after their successful cyber attack on or around May 27, 2020, the Hackers attempted to ransom the extracted data back to Agromart and Sollio AG. When Agromart or Sollio AG refused to pay the ransom, the Hackers advertised through a data breach blog on June 2, 2020, that they had extracted 22,328 files from Agromart’s computer system, and would be holding an auction to sell the data.

Between May 27 and June 2, 2020, the plaintiff alleges that Agromart and Sollio AG knew that they had been hacked, that customers’ highly sensitive information had been stolen, and that the data would be auctioned off on the dark web because the Defendants had refused to pay the ransom. Agromart and Sollio AG knew that their customers would be exposed to potential fraud, identity theft, and a myriad of other consequences and yet the Defendants did not warn their customers so that they could take steps to protect themselves.

The Breach was only publicly disclosed in an article published by the farming periodical Farmtario on June 23, 2020. A representative of Agromart and Sollio AG commented to Farmtario that the Breach was “minor” in scope, and that affected individuals had already been notified. This disclosure is alleged to be both minimal and false.

The plaintiff claims that victims of the Breach only received notice of the Breach months after the Hackers had already auctioned off their information, and after individuals such as the plaintiff were exposed to fraud. The notice provided by Agromart and Sollio AG claimed that they had only recently learned of the Breach when, in fact, they were aware that the Breach had occurred immediately following the Hackers’ ransom demand on or about May 27, 2020.

As a result of the Breach, the plaintiff alleges that the class members’ personal information has been compromised and that they have suffered damages. This class action seeks to obtain compensation for the losses the class has suffered from the Breach.

Who Represents Me?

The Court appointed Claims Administrator should be the first point of contact for all eligibility, payment and credit monitoring related inquiries. The Claims Administrator can be reached at:

Agromart Cyber-Security Privacy Breach Class Action
c/o RicePoint Administration Inc.
P.O. Box 3355
London, ON N6A 4K3
Email: agromartclassaction@ricepoint.com
Phone: 1.888.726.1789

All other case related inquiries should be directed to:

Foreman & Company
Attention: Agromart Class Action
4 Covent Market Pl
London, ON N6A 1E2
Email: classactions@foremancompany.com
Phone: 519.914.1175 x 107