Canada Life breach exposes contact information and some customer support tickets
Canada Life’s employee-account breach led to a leak containing about 237,800 email addresses and some support tickets. Some customer notices also listed sensitive insurance data. Verify unexpected messages and activate any credit monitoring offered.
If Canada Life notified you, follow the notice’s instructions to activate the free credit monitoring offered. Verify unexpected calls, emails or texts through contact details you already trust; Canada Life says it will not request passwords, one-time codes or sensitive personal information by email or text. There is no software update for customers to install.
What’s happening
Canada Life confirmed on 20 April that an unauthorised party had accessed applications through an employee account. A company notification reproduced in a court filing dates that access to 2 April. Have I Been Pwned subsequently recorded approximately 237,800 unique email addresses in published data, alongside contact details and some support tickets; that figure is an email-address count, not Canada Life’s confirmed customer total. Some customer notices also listed possible exposure of birth dates, earnings and insurance-plan information. On 7 May, Canada Life said its investigation was complete, the incident was contained and everyone identified as having sensitive personal data affected had been notified and offered free credit monitoring. A proposed class action was announced on 5 May; its allegations were unproven. Canada Life also warned of possible phishing targeting people connected to the company. As at 3 November, the sources reviewed do not establish removal of the leaked data or a final court outcome.
- What
- Breach
- Affects
- Canada Life customer and group-benefits records
- Fixed in
- Nothing to patch
- Since
- 2 Apr 2026
- Closed
- 13 May 2026
Timeline
- Update
Have I Been Pwned added approximately 237,800 unique email addresses from data it said ShinyHunters published following extortion. The data also included names, telephone numbers, postal addresses, job titles, salutations and some customer support tickets.
- Vendor revised
Canada Life said its investigation was complete and external specialists had confirmed containment, with no evidence of continuing unauthorised activity. It said everyone identified as having sensitive personal data affected had been notified and offered free credit monitoring.
- Update
Bob Buckingham Law announced a proposed class action filed in the Supreme Court of Newfoundland and Labrador. The firm said the allegations were unproven and the action required certification before proceeding as a class action.
- Update
Two customers received notifications, according to their subsequent court filing. The reproduced notice listed possible exposure of names, addresses, gender, earnings, birth dates and insurance details, and offered 24 months of free TransUnion credit monitoring.
- Made public
Canada Life publicly confirmed unauthorised access to certain applications through an employee account. It said the incident was contained, services continued and authorities had been notified.
- UpdateNothing to patch
An unauthorised party accessed an employee account, according to Canada Life’s customer notification reproduced in a subsequent court filing.
Sources
- Canada Life recently identified a cyber incidentCanada Life · 20 Apr 2026
- Update on recent cyber incidentCanada Life · 7 May 2026
- Be alert for suspicious communicationsCanada Life
- Canada Life Data BreachHave I Been Pwned · 13 May 2026
- Canada Life Data BreachMozilla Monitor · 13 May 2026
- Issued statement of claim: Boggan and Hynes v Canada LifeBob Buckingham Law
- Proposed class action filed against Canada Life over data breach affecting CanadiansBob Buckingham Law · 5 May 2026