The Quebec Superior Court on Monday, August 24, 2026, gave the green light for a class‑action lawsuit against drug distributor Cencora and its subsidiary Innomar after a cyber breach revealed the personal and medical information of patients in the province.
The court’s decision authorises a collective legal claim that will represent all Quebec residents whose records were accessed without authorization, allowing them to pursue damages and other remedies as a single group rather than through individual actions.
The breach originated in Cencora’s information‑technology infrastructure, where attackers gained entry to systems that stored patient health records, leading to the extraction of both identifying details and medical data.
Affected individuals reported that the stolen information includes names, contact information, health histories and treatment details, raising concerns about privacy, potential fraud and the misuse of sensitive health data.
By permitting a class action, the court aims to streamline the legal process, enabling the plaintiffs to pool resources and present a unified case against Cencora and Innomar for the alleged failure to protect patient information.
Both companies have been notified of the lawsuit and are expected to file responses in the coming weeks, after which the court will set a timetable for discovery and further proceedings.
The case adds to a growing number of legal actions in Canada addressing cybersecurity failures in the healthcare sector, where the protection of patient data is increasingly subject to judicial scrutiny.
If the class is certified, the plaintiffs will be able to claim compensation for any harms they allege resulted from the exposure, including costs associated with identity protection services, medical monitoring or other expenses linked to the unauthorized disclosure.