A class-action lawsuit has been dismissed against a former Laurentian University student who pleaded guilty in 2019 to mischief charges after he hacked into the school’s computer system.
LU computer science grad Spencer Brydges and the university were named in a class-action lawsuit filed on behalf of certain Laurentian students and staff members. The lawsuit stems from a 2017 data breach into the university’s computer network, a breach Brydges is alleged to have committed.
On May 5, it was announced the plaintiff and Brydges have reached a settlement.
“In consideration for Brydges' co-operation in the litigation against Laurentian, the action will be dismissed against Brydges,” said McKenzie Lake Lawyers LLP in a news release.
More details of that settlement will be released, said McKenzie Lake Lawyers LLP.
The settlement has no impact on the lawsuit against Laurentian, which will continue to be litigated.
McKenzie Lake Lawyers LLP said the proposed class action against Laurentian has not been certified to proceed as a class action, and the plaintiff's claims against Laurentian have not been evaluated on their merits.
Brydges was arrested and charged in 2017 with unauthorized use of a computer system, mischief to data and breach of probation after he hacked into the university’s computer network. https://www.sudbury.com/local-news/hacker-says-he-found-dozens-of-weaknesses-in-laurentians-security-683361
In January 2019, Brydges, pleaded guilty to an amended charge of mischief and a charge of breach of probation. He received a conditional discharge, one year of probation and was required to perform 25 hours of community service.
Brydges told Sudbury.com in August 2017 he had hacked into the system in hopes of pointing out what he called gaping holes in LU’s cyber security. Brydges said he didn’t cause any damage, nor did he install any malware or do anything malicious, and he advised the university of what he’d found in hopes the school would fix it.
From Jan. 23-25 of 2017, he went “as deep as I could into the system.” Brydges said he got “exceptionally far” and managed to uncover dozens of system vulnerabilities. He said he was able to access sensitive information like student social insurance numbers, addresses and banking information, and that there was no way for the university to determine if he’d downloaded any of that information.
He believes police were called when Laurentian realized how much information he was able to access.
Brydges said he wrote a report for the school on what he had done and what he had found. He made no effort to disguise his actions. He used his own computer and didn’t mask his IP address.
Six months later, in August 2017, police tactical officers used a battering ram to force open the door of his parents’ house, arrest him and seize his devices.
McKenzie Lake Lawyers LLP said anyone wishing to object to the terms of the proposed settlement with Brydges must do so by Oct. 9, 2020.
