Prosura Insurance Hit by Cyberattack, Customer Data at Risk Australian and New Zealand insurer Prosura (also operating as Hiccup) has confirmed a cyberattack after a threat actor claimed to have stolen customer data and demanded a deal to prevent its release. The company, which provides rental car accident insurance, has temporarily suspended new policy sales and its online self-service portal while investigating the breach. Prosura detected unauthorized access to its systems on Saturday, revealing that compromised data may include names, email addresses, phone numbers, travel details, policy information, and claim-related documents, such as driver’s licenses and images. While the company stated that credit card details were not accessed—as it does not store them—it acknowledged that some customers received fraudulent emails related to older policies. The threat actor, who claimed to have breached Prosura’s systems on New Year’s Day, accused the company of ignoring earlier attempts to report the vulnerability. In an email sent to victims, the attacker referenced specific policy numbers and falsely offered a free "policy extension" dated January 3, pressuring Prosura to respond or face a full data leak. Prosura founder Mike Boyd confirmed that the attackers had used aggressive tactics, including direct contact with customers, and urged recipients to ignore suspicious messages. The company has notified authorities and implemented additional security measures but has not disclosed the number of affected customers. The breach follows a string of high-profile cyber incidents in Australia, including attacks on Optus (2022), HWL Ebsworth (2023), and Qantas (2025), highlighting persistent vulnerabilities in corporate cybersecurity. A New Zealand victim, who purchased Prosura insurance through the affiliated VroomVroomVroom rental comparison site in mid-2024, reported receiving the fraudulent email and expressed concerns over potential identity theft risks, particularly regarding exposed personal details like full names and dates of birth. Prosura has not provided further details on the breach, citing the ongoing investigation.