Prosura insurance breach exposed customer data as alleged attacker emailed policyholders
Prosura and Hiccup rental-car insurance customers may have had contact, travel, policy and claims data exposed, including licence images. Some received attacker emails. Ignore unexpected policy messages and contact Prosura through its official website.
If you used Prosura or Hiccup, including through VroomVroomVroom, ignore unexpected policy extensions and messages asking you to contact a third-party address; do not open their links or attachments. Contact Prosura through its official website to ask whether your information, especially any licence documents supplied with a claim, was affected. There is no software update for customers to install.
What’s happening
Prosura, which also trades as Hiccup and provides rental-car excess insurance in Australia and New Zealand, detected unauthorised access on 3 January 2026. Its statements quoted in January reports said potentially compromised information included names, email addresses, phone numbers, country of residence, travel destinations, invoices, pricing and policy dates. Claims records could also include drivers’ licences and related images. Prosura said it did not store credit card details and had no indication payment information was accessed. The alleged attacker emailed customers and threatened disclosure; later reporting described data offered for sale, with unconfirmed estimates of 300,000 to 500,000 people. Online purchases and self-service functions were temporarily suspended, while existing cover remained valid. As of 3 November, the reviewed sources provide no confirmed final customer count, completion of individual notifications, recovery or deletion of stolen data, or charges. Prosura’s original incident page could not be retrieved, limiting direct verification of its latest position.
- What
- Breach
- Affects
- Prosura and Hiccup rental-car excess insurance
- Fixed in
- Nothing to patch
- Since
- 3 Jan 2026
- Closed
- 22 Jan 2026
Timeline
- Update
Assured reported that the alleged attacker was advertising data claimed to concern 500,000 people; another estimate was about 300,000. Neither figure was confirmed by Prosura, and Assured described the self-service portal interruption as lasting close to two weeks.
- Update
The Cyber Express reported that Prosura had notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner. Prosura said it would contact affected people directly once it confirmed which information was involved.
- Update
ABC reported that the alleged attacker threatened to release customer data unless Prosura reached an agreement. Prosura said potentially compromised records included contact, travel, policy and claims information, but did not disclose an affected-customer count.
- Made public
Managing director Mike Boyd confirmed the incident, according to Insurance Business. Prosura suspended online policy purchases, claims functions and policy administration while investigating; existing insurance cover remained valid.
- UpdateNothing to patch
Prosura detected unauthorised access to its systems. Customers also received emails from someone claiming responsibility, who alleged the intrusion began on 1 January; that start date was not confirmed by Prosura.
Sources
- Insurer Prosura hit by cyber data breach, customers contacted by 'threat actor'ABC News · 7 Jan 2026
- Rental car insurer Prosura confirms cyber incident as alleged threat actor contacts victimsCyber Daily · 7 Jan 2026
- Prosura cyber incident triggers shutdown of key online servicesInsurance Business · 7 Jan 2026
- Australian Insurer Prosura Confirms Cyber Incident, Takes Online Services Offline Amid InvestigationThe Cyber Express · 8 Jan 2026
- AI Autopsy: A Data Breach Down Under at Insurer ProsuraAssured · 22 Jan 2026