Canada Life Cyber Incident Exposes Personal Data of Up to 70,000 Individuals Canada Life has confirmed a cybersecurity incident involving unauthorized access to customer data through a compromised employee account. The breach, detected in recent weeks, exposed personal information including names, addresses, dates of birth, phone numbers, and account numbers for up to 70,000 individuals, primarily employees covered under a large corporate group benefits plan. Payment details and passwords were not compromised. The attack was traced to the criminal group ShinyHunters, which gained access via a subcontractor’s account linked to Freedom Mobile’s platform. Canada Life has engaged third-party cybersecurity experts to investigate and has notified authorities. While the company stated the incident was contained and operations remain unaffected, affected individuals will be contacted directly and offered free credit monitoring. The breach follows a pattern of recent cyber incidents in Canada, including a Loblaw breach exposing basic customer data (names, emails, and phone numbers) and a Telus Digital intrusion also attributed to ShinyHunters. Earlier in 2025, a phishing attack disclosed in August revealed a far larger compromise than initially reported, affecting 750,000 investors with sensitive financial data. Canada Life emphasized its commitment to customer protection and is working to assess the full scope of the impact. The incident underscores the growing threat of cyberattacks targeting employee accounts and third-party vulnerabilities in corporate systems.

Loblaw Faces Alleged Massive Data Breach as Threat Actor Demands Response A threat actor operating under the handle "igotafeeling" on the DarkWeb Informer forum has claimed to have breached Loblaw, Canada’s largest food and pharmacy retailer, which owns brands like President’s Choice, No Frills, Shoppers Drug Mart, Real Canadian Superstore, and the PC Optimum loyalty program. The actor alleges possession of over 1.8 billion records, including: - 75.1 million Salesforce customer records (names, emails, phone numbers, addresses, loyalty IDs, and health card numbers) - 724.9 million Shoppers Drug Mart records (passwords, tokens, loyalty IDs, payment details, and full credit card numbers with expiry dates) - 129.9 million pharmacy fill requests (prescription numbers and patient IDs) - 120.4 million e-commerce fraud-feed records (payment card BINs, last-four digits, and expiry dates) - 20.2 million Delivery Ops Portal records (orders, deliveries, and postal codes) - 3,014 GitLab projects containing Loblaw’s full source code - 19.3 million Oracle identity records (MFA device details and credentials) - 55.3 million marketing and email records across 673 tables The threat actor has given Loblaw until March 19 to respond, accusing the company of "ghosting" them and dismissing customer and investor concerns. They have also invited media organizations to verify the data’s authenticity. In response, Loblaw issued a March 12 press release, labeling the incident a "low-level data breach" and stating that only "basic customer information" (names, phone numbers, and emails) may have been accessed. The company explicitly denied evidence of financial or credit card data compromise directly contradicting the threat actor’s claims. While the breach remains unverified, the scale of the alleged exposure if confirmed would rank among the largest in Canadian history. The situation mirrors past high-profile breaches (e.g., T-Mobile, Equifax, Capital One), where initial corporate statements downplayed impact before later revelations proved otherwise. Loblaw customers with PC Optimum accounts, Shoppers Drug Mart loyalty cards, or prescription histories may be affected if the claims hold true. The deadline for Loblaw’s response is six days away.

Crunchyroll Suffers Major Data Breach: 100 GB of PII Exfiltrated A threat actor claims to have stolen approximately 100 GB of personally identifiable information (PII) from Crunchyroll, the Sony-owned anime streaming platform, following a breach on March 12, 2026. The attack reportedly originated from a compromised employee account at Telus, Crunchyroll’s outsourcing partner, which provided the attacker with initial access to the company’s internal systems. Once inside, the threat actor conducted lateral movement, infiltrating sensitive customer-facing infrastructure, including Crunchyroll’s ticketing systems. As of this report, Crunchyroll has not publicly confirmed the breach, leaving the full scope and impact of the incident unclear. The exfiltrated data’s nature and potential exposure of user details remain unconfirmed.

Telus Investigates Cybersecurity Breach as ShinyHunters Claims Massive Data Theft Canadian telecommunications provider Telus is probing a cybersecurity incident after the hacking group ShinyHunters alleged it stole up to 700 terabytes of data from the company’s systems. The Vancouver-based firm confirmed on Thursday that it detected unauthorized access to certain internal systems but stated that business operations and customer services remain unaffected. Telus has engaged digital forensics experts and is collaborating with law enforcement to assess the breach’s scope. While the company has not confirmed the volume or nature of compromised data, samples shared by ShinyHunters with Reuters reportedly include personally identifiable information, call records, FBI background check details, and software source code linked to multiple corporate divisions. Reuters has not independently verified the data’s authenticity. ShinyHunters, a group with a history of high-profile attacks, has previously targeted organizations like Dutch telecom Odido, PornHub, and Wynn Resorts. The group recently claimed responsibility for a breach exposing over six million Odido customer accounts. Telus continues its investigation to determine how the intrusion occurred and whether sensitive customer or partner data was accessed. The company has begun notifying affected individuals where necessary.

Telus Investigates Cybersecurity Breach Linked to ShinyHunters Extortion Group Canadian telecommunications giant Telus Corp. is probing a cybersecurity incident involving unauthorized access to a limited number of its systems. The company confirmed the breach in a statement, noting that immediate steps were taken to contain the intrusion and secure affected systems. Telus is actively monitoring the situation and has begun notifying impacted customers. The breach was claimed by ShinyHunters, an extortion group that contacted Bloomberg News this week, alleging they stole a large volume of data from Telus in a supply chain attack in August. The group claimed to have sent a ransom note in February, demanding payment in Bitcoin though the exact amount was redacted. According to ShinyHunters, the exposed data includes information belonging to Telus’ customers, which span technology companies and banks. Telus, one of Canada’s largest mobile and broadband providers, stated it is collaborating with law enforcement and cyber forensics experts while maintaining that business operations remain unaffected. There is no evidence of disruption to connectivity or services. The company did not directly address ShinyHunters’ claims or name the group in its response. Following the news, Telus shares dipped 0.6%, trading at C$17.93 in Toronto. The incident underscores growing risks in third-party supply chain attacks targeting major telecommunications providers.

Telus Investigates Cybersecurity Breach Amid System Hack Telus Corporation, one of Canada’s largest telecommunications providers, is actively investigating a hack of its systems, the company confirmed. The breach was disclosed amid growing concerns over cybersecurity threats targeting critical infrastructure. While details remain limited, the incident highlights the ongoing risks faced by major corporations in safeguarding sensitive data. Telus, headquartered in Vancouver, has not yet released specifics on the scope of the breach, potential data exposure, or the methods used by attackers. The investigation comes as cyber threats continue to escalate, with high-profile breaches affecting industries from healthcare to finance. No further information on the timeline or impact has been provided, but the company is likely working with cybersecurity experts to assess and mitigate the fallout. As of now, Telus has not indicated whether customer or employee data was compromised, but the incident underscores the persistent challenges in defending against evolving cyber threats. Further updates are expected as the investigation progresses.