Rouge Valley Health System in Scarborough, Ont. is facing a $412-million class-action lawsuit after two employees sold the personal information of 8,300 new mothers to RESP companies, reports CP24.

The OSC and Privacy Commissioner of Ontario are aware of the breach, and the hospital has confirmed the allegations.

Read: Your car can be hacked

The leaks happened over two years. It’s not the first time staff at Ontario hospitals have misused patient information. There have been other breaches at unrelated facilities in Peterborough and Sault Ste. Marie.

Read the story here.

Also read:

Hackers compromise security of 47% of Americans

Don’t announce vacation details on Facebook

FATCA harms Canadians’ privacy