Capital One Data Breach Settlement in Canada: C$35 Million Deal Awaits Court Approval

Capital One Data Breach Settlement in Canada: C$35 Million Deal Awaits Court Approval

Capital One has proposed a C$35,000,000 settlement over its 2019 data breach, which exposed the personal information of roughly six million Canadian residents. The deal is not final: class members must opt out by September 11, 2026, and a British Columbia Supreme Court judge will decide whether to approve it at a September 22, 2026 hearing.

Information last verified on July 21, 2026. This is a developing story; we update it as the record changes.

Status: Proposed settlement awaiting British Columbia Supreme Court approval; opt-out deadline September 11, 2026; approval hearing September 22, 2026 (as of July 21, 2026).

Jurisdiction scope: This settlement applies to the certified class action pending in the Supreme Court of British Columbia. It covers Canadian residents outside Quebec, since Quebec class members are excluded from this deal and are instead covered by a separate proceeding in the Quebec Superior Court, not left without recourse. This is a distinct case from Capital One's earlier United States litigation and settlement over the same 2019 breach, and distinct from any Quebec action.

What Happened

In the spring of 2019, a former Amazon Web Services engineer, Paige Thompson, exploited a misconfigured firewall in Capital One's cloud environment to access personal information belonging to roughly 100 million people in the United States and about six million people in Canada, including Social Insurance Numbers for a subset of Canadian applicants. Capital One reported the incident to the Office of the Privacy Commissioner of Canada in July 2019, and the Office opened an investigation shortly after.

Canadian plaintiffs filed a proposed class action against Capital One Financial Corporation, Capital One Bank (USA), National Association, and Capital One Bank (Canada Branch) in the Supreme Court of British Columbia. The case was certified as a class proceeding, and the parties later reached a proposed settlement rather than proceeding to trial.

Notice of the proposed settlement began running on July 13, 2026, with a Newswire.ca release published July 16, 2026, and full details posted to the administrator site, capitalone2019classaction.ca. Daily Hive and other Canadian outlets corroborated the terms in the days that followed. Under the proposal, Capital One would pay C$35,000,000 to resolve the claims of all class members in Canada except residents of Quebec, without admitting liability. The BC Supreme Court will hold a settlement approval hearing on September 22, 2026, at 800 Smithe Street in Vancouver, where a judge will decide whether the deal is fair and in the best interests of the class.

What the Law Actually Says

Canada does not have a single national class-action statute. British Columbia's Class Proceedings Act governs how a case like this one is certified, settled, and approved, and it requires a court, not the parties, to sign off before any settlement binds the class. That is why the September 22, 2026 hearing matters: until a judge approves the deal, the C$35 million figure and the payment tiers in the notice remain proposed terms, not a guaranteed payout.

The notice-and-opt-out process now underway is standard for a Canadian class settlement. Class members do not need to do anything to stay in the class and remain eligible for a payment if approved. A class member who instead wants to preserve an individual right to sue Capital One separately must opt out, in writing, through the official settlement website before September 11, 2026. Opting out and filing a claim are different, mutually exclusive steps, and neither is the same as the court's approval decision.

The underlying breach also sits inside Canada's federal private-sector privacy framework. For more on how that framework works, including breach-notification duties for companies like Capital One, see our explainer on PIPEDA, Canada's private-sector privacy law. PIPEDA covers private organizations; it is a separate statute from the Privacy Act, which governs how federal government institutions, not banks, handle personal information. Quebec residents are excluded from this settlement because Quebec has its own privacy and civil procedure regime, most recently updated by Quebec's Law 25, and Quebec class members are typically addressed through separate provincial proceedings rather than folded into a British Columbia class.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

A proposed C$35 million settlement for a breach that touched roughly six million Canadian residents works out to a modest per-person figure before any claims-volume adjustment, typical for data-breach class settlements once legal fees, administration costs, and a broad claims pool are factored in. The tiered structure, a base payment for time spent, a documented-loss category reaching up to C$25,000 for out-of-pocket costs or identity theft tied to the breach, and a possible additional amount tied to how many people ultimately file, reflects how Canadian data-breach settlements are usually built: modest guaranteed compensation, with the largest payouts reserved for class members who can document real costs.

The more consequential date for most class members is not a payment date at all. It is September 22, 2026, when a BC Supreme Court judge decides whether the deal is approved. Nothing about the payment tiers or final payout amounts is locked in before that hearing. Readers should treat every figure in the notice as a proposal under judicial review, not a confirmed benefit, until the court rules.

How This Affects You

If you applied for or held a Capital One credit card in Canada and received a breach notification letter in 2019, you are likely a member of this class. You do not need to file anything to remain in the class and stay eligible for a payment if the settlement is approved; inaction keeps you in. Some class members instead prefer to opt out so they retain the option to pursue an individual claim against Capital One outside this settlement; that choice has its own trade-offs and its own September 11, 2026 deadline, and it is a personal decision this article does not recommend either way.

Whichever path a class member chooses, no legitimate part of this process asks for payment details, a credit card number, or a Social Insurance Number simply to confirm class membership or process an opt-out. Anyone unsure whether they are included in the class can contact the settlement administrator directly through the official site, capitalone2019classaction.ca, rather than through a search result or an unsolicited email. Because the underlying breach exposed Social Insurance Numbers for some Canadian class members, anyone affected may want to review our guide on freezing credit after a data breach, which explains the practical steps regardless of where this settlement ends up.

This article covers the proposed Capital One 2019 data breach class action settlement in Canada, excluding Quebec, as verified on July 21, 2026. It is general legal information, not legal advice, and does not create a lawyer-client relationship. Class members with questions about their individual rights, including whether to opt out, should consult the official settlement notice at capitalone2019classaction.ca or an independent lawyer. Recording Law is not the settlement administrator, the court, or a party to this litigation, and filing, opting out, and claims can only be completed through the official BC Supreme Court-approved administrator site.

Last updated: 2026-07-21. This article will be updated as the settlement moves toward the September 22, 2026 court approval hearing and beyond.