Canada Life says employee account was used to reach customer data
Canada Life says it has identified a cyber incident in which an attacker used an employee account to gain unauthorized access to certain applications, and that it will contact people whose personal information was affected and offer them free credit monitoring.
As one of the country's largest life and health insurers and a major administrator of workplace benefits and retirement plans, Canada Life holds data on millions of Canadians. A breach at an insurer can expose people who never dealt with the company directly, because their employer chose it as a plan provider.
What happened
In a statement on its website, the company said the incident is contained, its operations and services are continuing as normal, and it has launched an investigation with outside cybersecurity experts and notified authorities. Its current assessment is that only a small proportion of customers may have been affected.
Canadian HR Reporter reported that up to 70,000 people may be affected, most of them employees covered by a single large corporate group benefits and retirement plan. The exposed information includes names, dates of birth, mailing addresses, gender and annual income levels, according to the report, which cited The Globe and Mail.
The extortion group ShinyHunters claimed on April 17 on X that it had taken personal information from eight major companies, Canada Life among them, according to Canadian HR Reporter. Canada Life has not publicly attributed the attack.
What we don't know yet
The company says it is still finalizing its analysis of the full scope. It has not named the corporate client whose plan members make up most of those affected or explained how the employee account was compromised.
What to do
- Watch for a direct notice from Canada Life and enrol in the free credit monitoring it offers.
- Be cautious of calls or emails about your benefits or pension that ask you to confirm personal or banking details. Call Canada Life using the number on your benefits card instead.
- Employers with group plans at Canada Life should prepare to answer staff questions and warn them about benefit-themed phishing.
