The Toronto Sun reports that Ottawa's Montfort Hospital is being sued for $40 million by a group of patients whose personal data was exposed in a recent security breach (h/t

An unencrypted USB drive was lost late last year that contained more than 25,000 patients' names, summary data on services provided, dates of service, and health service provider coes.

The lawsuit accuses the Montfort Hospital of breach of contract, breach of privacy, and violating its own bylaws and Ontario's Personal Health Information and Protection Act (PHIPA), the Sun reports.

According to the Sun, the statement of claim reads, "The contract offered peace of mind to the plaintiffs and the class members. [They] believed that their personal information would be kept in a secure manner and would not be lost, disseminated or disclosed to unauthorized persons."

The lawsuit also claims that the hospital "failed to disclose the loss of personal information in a timely manner."