SUDBURY -- A former Laurentian University student who hacked into the school's computer database in 2017 has reached an agreement with a law firm that filed a class-action lawsuit against him in connection with the breach.
Spencer Brydges accessed the private database in January 2017, discovering security gaps. Brydges was able to access the private information of the 2,000 students and staff at the school, including social insurance numbers, tax information and academic records. He said at the time it wasn't a malicious breach, he just wanted to help the school by showing it the flaws in its security system.
But after he reported what he had done to Laurentian, he ended up being banned from campus and was charged by Greater Sudbury Police with unauthorized use of a computer system, mischief to data and breach of probation. He was convicted in 2019 and received probation.
London-based McKenzie Lake Lawyers launched a class-action lawsuit on behalf of the students affected by the breach, seeking $40 million in damages for such things as breach of contract, negligence and breach of confidentiality. The suit also seeks $5 million for "exemplary, punitive and aggravated" damages.
Both Brydges and Laurentian University were named in the class-action suit, which covers all of the roughly 2,000 students affected by the breach, unless they opt out by March of this year. The suit has yet to be certified in court and Laurentian University denies all claims against it.
Under the terms of the settlement, "Brydges has agreed to cooperate with the plaintiff by providing information regarding his role in the alleged data breach," the law firm said Friday. "There is no monetary benefit being paid as part of this settlement."
A court proceeding has been scheduled April 7-8 to hear the contested motion to certify the lawsuit.
