{"id":"canada-life-customer-data-breach-apr-2026","category":"breach","status":"closed","title":"Canada Life breach exposes contact information and some customer support tickets","tldr":"Canada Life’s employee-account breach led to a leak containing about 237,800 email addresses and some support tickets. Some customer notices also listed sensitive insurance data. Verify unexpected messages and activate any credit monitoring offered.","summary":"Canada Life confirmed on 20 April that an unauthorised party had accessed applications through an employee account. A company notification reproduced in a court filing dates that access to 2 April. Have I Been Pwned subsequently recorded approximately 237,800 unique email addresses in published data, alongside contact details and some support tickets; that figure is an email-address count, not Canada Life’s confirmed customer total. Some customer notices also listed possible exposure of birth dates, earnings and insurance-plan information. On 7 May, Canada Life said its investigation was complete, the incident was contained and everyone identified as having sensitive personal data affected had been notified and offered free credit monitoring. A proposed class action was announced on 5 May; its allegations were unproven. Canada Life also warned of possible phishing targeting people connected to the company. As at 3 November, the sources reviewed do not establish removal of the leaked data or a final court outcome.","action":"If Canada Life notified you, follow the notice’s instructions to activate the free credit monitoring offered. Verify unexpected calls, emails or texts through contact details you already trust; Canada Life says it will not request passwords, one-time codes or sensitive personal information by email or text. There is no software update for customers to install.","product":"Canada Life customer and group-benefits records","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["canada-life","data-breach","insurance","customer-support","extortion","phishing"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Canada Life recently identified a cyber incident","url":"https://www.canadalife.com/about-us/news-highlights/news/canada-life-recently-identified-a-cyber-incident.html","by":"Canada Life","date":"2026-04-20"},{"kind":"advisory","title":"Update on recent cyber incident","url":"https://www.canadalife.com/about-us/news-highlights/news/update-on-recent-cyber-incident.html","by":"Canada Life","date":"2026-05-07"},{"kind":"advisory","title":"Be alert for suspicious communications","url":"https://www.canadalife.com/fraud-prevention/suspicious-communications.html","by":"Canada Life","date":""},{"kind":"research","title":"Canada Life Data Breach","url":"https://haveibeenpwned.com/Breach/CanadaLife","by":"Have I Been Pwned","date":"2026-05-13"},{"kind":"research","title":"Canada Life Data Breach","url":"https://monitor.mozilla.org/en/breach-details/CanadaLife","by":"Mozilla Monitor","date":"2026-05-13"},{"kind":"post","title":"Issued statement of claim: Boggan and Hynes v Canada Life","url":"https://buckinghamlaw.ca/wp-content/uploads/2026/05/Issued-Statement-of-Claim.pdf","by":"Bob Buckingham Law","date":""},{"kind":"post","title":"Proposed class action filed against Canada Life over data breach affecting Canadians","url":"https://buckinghamlaw.ca/wp-content/uploads/2026/05/Press-Release-May-5-2026.pdf","by":"Bob Buckingham Law","date":"2026-05-05"}],"started":"2026-04-02","closed":"2026-05-13","created":"2026-11-03T21:52:08.490Z","updated":"2026-11-03T21:52:08.490Z","cve_notes":[],"timeline":[{"at":"2026-05-13","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Have I Been Pwned added approximately 237,800 unique email addresses from data it said ShinyHunters published following extortion. The data also included names, telephone numbers, postal addresses, job titles, salutations and some customer support tickets.","url":"https://haveibeenpwned.com/Breach/CanadaLife","by":"Have I Been Pwned","patch":null},{"at":"2026-05-07","added":"2026-11-03T21:45:10.669Z","kind":"vendor-revised","text":"Canada Life said its investigation was complete and external specialists had confirmed containment, with no evidence of continuing unauthorised activity. It said everyone identified as having sensitive personal data affected had been notified and offered free credit monitoring.","url":"https://www.canadalife.com/about-us/news-highlights/news/update-on-recent-cyber-incident.html","by":"Canada Life","patch":null},{"at":"2026-05-05","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Bob Buckingham Law announced a proposed class action filed in the Supreme Court of Newfoundland and Labrador. The firm said the allegations were unproven and the action required certification before proceeding as a class action.","url":"https://buckinghamlaw.ca/wp-content/uploads/2026/05/Press-Release-May-5-2026.pdf","by":"Bob Buckingham Law","patch":null},{"at":"2026-04-22","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Two customers received notifications, according to their subsequent court filing. The reproduced notice listed possible exposure of names, addresses, gender, earnings, birth dates and insurance details, and offered 24 months of free TransUnion credit monitoring.","url":"https://buckinghamlaw.ca/wp-content/uploads/2026/05/Issued-Statement-of-Claim.pdf","by":"Bob Buckingham Law","patch":null},{"at":"2026-04-20","added":"2026-11-03T21:45:10.669Z","kind":"disclosed","text":"Canada Life publicly confirmed unauthorised access to certain applications through an employee account. It said the incident was contained, services continued and authorities had been notified.","url":"https://www.canadalife.com/about-us/news-highlights/news/canada-life-recently-identified-a-cyber-incident.html","by":"Canada Life","patch":null},{"at":"2026-04-02","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"An unauthorised party accessed an employee account, according to Canada Life’s customer notification reproduced in a subsequent court filing.","url":"https://buckinghamlaw.ca/wp-content/uploads/2026/05/Issued-Statement-of-Claim.pdf","by":"Bob Buckingham Law","patch":"na"}],"url":"https://hard.fyi/live/canada-life-customer-data-breach-apr-2026/","json":"https://hard.fyi/api/live?id=canada-life-customer-data-breach-apr-2026"}