Canada Life Cyber Incident Exposes Personal Data of Up to 70,000 Individuals Canada Life has confirmed a cybersecurity incident involving unauthorized access to customer data through a compromised employee account. The breach, detected in recent weeks, exposed personal information including names, addresses, dates of birth, phone numbers, and account numbers for up to 70,000 individuals, primarily employees covered under a large corporate group benefits plan. Payment details and passwords were not compromised. The attack was traced to the criminal group ShinyHunters, which gained access via a subcontractor’s account linked to Freedom Mobile’s platform. Canada Life has engaged third-party cybersecurity experts to investigate and has notified authorities. While the company stated the incident was contained and operations remain unaffected, affected individuals will be contacted directly and offered free credit monitoring. The breach follows a pattern of recent cyber incidents in Canada, including a Loblaw breach exposing basic customer data (names, emails, and phone numbers) and a Telus Digital intrusion also attributed to ShinyHunters. Earlier in 2025, a phishing attack disclosed in August revealed a far larger compromise than initially reported, affecting 750,000 investors with sensitive financial data. Canada Life emphasized its commitment to customer protection and is working to assess the full scope of the impact. The incident underscores the growing threat of cyberattacks targeting employee accounts and third-party vulnerabilities in corporate systems.

Loblaw Faces Alleged Massive Data Breach as Threat Actor Demands Response A threat actor operating under the handle "igotafeeling" on the DarkWeb Informer forum has claimed to have breached Loblaw, Canada’s largest food and pharmacy retailer, which owns brands like President’s Choice, No Frills, Shoppers Drug Mart, Real Canadian Superstore, and the PC Optimum loyalty program. The actor alleges possession of over 1.8 billion records, including: - 75.1 million Salesforce customer records (names, emails, phone numbers, addresses, loyalty IDs, and health card numbers) - 724.9 million Shoppers Drug Mart records (passwords, tokens, loyalty IDs, payment details, and full credit card numbers with expiry dates) - 129.9 million pharmacy fill requests (prescription numbers and patient IDs) - 120.4 million e-commerce fraud-feed records (payment card BINs, last-four digits, and expiry dates) - 20.2 million Delivery Ops Portal records (orders, deliveries, and postal codes) - 3,014 GitLab projects containing Loblaw’s full source code - 19.3 million Oracle identity records (MFA device details and credentials) - 55.3 million marketing and email records across 673 tables The threat actor has given Loblaw until March 19 to respond, accusing the company of "ghosting" them and dismissing customer and investor concerns. They have also invited media organizations to verify the data’s authenticity. In response, Loblaw issued a March 12 press release, labeling the incident a "low-level data breach" and stating that only "basic customer information" (names, phone numbers, and emails) may have been accessed. The company explicitly denied evidence of financial or credit card data compromise directly contradicting the threat actor’s claims. While the breach remains unverified, the scale of the alleged exposure if confirmed would rank among the largest in Canadian history. The situation mirrors past high-profile breaches (e.g., T-Mobile, Equifax, Capital One), where initial corporate statements downplayed impact before later revelations proved otherwise. Loblaw customers with PC Optimum accounts, Shoppers Drug Mart loyalty cards, or prescription histories may be affected if the claims hold true. The deadline for Loblaw’s response is six days away.

Crunchyroll Suffers Major Data Breach: 100 GB of PII Exfiltrated A threat actor claims to have stolen approximately 100 GB of personally identifiable information (PII) from Crunchyroll, the Sony-owned anime streaming platform, following a breach on March 12, 2026. The attack reportedly originated from a compromised employee account at Telus, Crunchyroll’s outsourcing partner, which provided the attacker with initial access to the company’s internal systems. Once inside, the threat actor conducted lateral movement, infiltrating sensitive customer-facing infrastructure, including Crunchyroll’s ticketing systems. As of this report, Crunchyroll has not publicly confirmed the breach, leaving the full scope and impact of the incident unclear. The exfiltrated data’s nature and potential exposure of user details remain unconfirmed.

Telus Investigates Cybersecurity Breach as ShinyHunters Claims Massive Data Theft Canadian telecommunications provider Telus is probing a cybersecurity incident after the hacking group ShinyHunters alleged it stole up to 700 terabytes of data from the company’s systems. The Vancouver-based firm confirmed on Thursday that it detected unauthorized access to certain internal systems but stated that business operations and customer services remain unaffected. Telus has engaged digital forensics experts and is collaborating with law enforcement to assess the breach’s scope. While the company has not confirmed the volume or nature of compromised data, samples shared by ShinyHunters with Reuters reportedly include personally identifiable information, call records, FBI background check details, and software source code linked to multiple corporate divisions. Reuters has not independently verified the data’s authenticity. ShinyHunters, a group with a history of high-profile attacks, has previously targeted organizations like Dutch telecom Odido, PornHub, and Wynn Resorts. The group recently claimed responsibility for a breach exposing over six million Odido customer accounts. Telus continues its investigation to determine how the intrusion occurred and whether sensitive customer or partner data was accessed. The company has begun notifying affected individuals where necessary.

Canadian Data Breaches Hit Record Costs in 2026, IBM Report Finds A new report from IBM reveals that data breaches in Canada reached an average cost of $7.11 million per incident in 2026, up from $6.98 million in 2025. The breaches exposed an average of 28,500 records an 8% increase from the previous year and took 205 days to detect and contain, a 6% rise in response time. The rising costs stem from the complex aftermath of breaches, including business disruption, recovery efforts, legal obligations, and customer communications, according to Chris Sicard, IBM Canada’s security leader. Some companies even pass recovery expenses to clients, amplifying the financial strain. The report defines data breaches as incidents compromising personally identifiable, financial, medical, or proprietary information, with some attacks exposing up to 115,380 records. High-profile Canadian companies including Rogers, Fido, Telus Digital, Loblaw, Canada Computers, and Ardene have reported breaches in 2026. Energy companies faced the highest average breach costs at $9.21 million, followed by technology firms ($9.02 million) and industrial organizations ($8.89 million). Sicard attributed the higher costs to their larger networks, sensitive data, and low tolerance for downtime, making them prime targets for attackers. The report also highlighted the role of AI in cybersecurity, with organizations using AI extensively reporting lower breach costs ($5.5 million vs. $8.91 million) and faster response times 124 days to detect and 57 to contain, compared to 154 days and 71 days for non-AI adopters. AI is increasingly used for vulnerability patching, breach detection, and containment, improving efficiency in mitigating attacks.

Telus Investigates Cybersecurity Breach Linked to ShinyHunters Extortion Group Canadian telecommunications giant Telus Corp. is probing a cybersecurity incident involving unauthorized access to a limited number of its systems. The company confirmed the breach in a statement, noting that immediate steps were taken to contain the intrusion and secure affected systems. Telus is actively monitoring the situation and has begun notifying impacted customers. The breach was claimed by ShinyHunters, an extortion group that contacted Bloomberg News this week, alleging they stole a large volume of data from Telus in a supply chain attack in August. The group claimed to have sent a ransom note in February, demanding payment in Bitcoin though the exact amount was redacted. According to ShinyHunters, the exposed data includes information belonging to Telus’ customers, which span technology companies and banks. Telus, one of Canada’s largest mobile and broadband providers, stated it is collaborating with law enforcement and cyber forensics experts while maintaining that business operations remain unaffected. There is no evidence of disruption to connectivity or services. The company did not directly address ShinyHunters’ claims or name the group in its response. Following the news, Telus shares dipped 0.6%, trading at C$17.93 in Toronto. The incident underscores growing risks in third-party supply chain attacks targeting major telecommunications providers.

Canadian Data Breaches Hit Record Costs as AI Emerges as a Key Defense Canadian companies faced rising financial and operational fallout from data breaches in 2026, with average costs climbing to $7.11 million per incident up from $6.98 million in 2025 according to an IBM report released this week. The breaches exposed an average of 28,500 records, an 8% increase from the previous year, and took 205 days to detect and contain, a 6% rise in response time. The financial burden stems not just from the attacks themselves but from the cascading effects: business disruption, recovery efforts, legal obligations, and customer impact. Some companies even passed recovery costs to clients, while others, like Rogers, Fido, Telus Digital, Loblaw, Canada Computers, and Ardene, reported breaches in 2026. Energy companies bore the highest average costs at $9.21 million per breach, followed by technology firms ($9.02 million) and industrial organizations ($8.89 million). IBM attributed the disparity to their complex networks, sensitive data, and low tolerance for downtime, making them prime targets for attackers. The report highlighted AI as a critical tool in mitigating breaches. Organizations using AI extensively in security operations reported lower average costs ($5.5 million vs. $8.91 million) and faster response times 124 days to detect and 57 to contain breaches, compared to 154 and 71 days for non-AI adopters. However, 28% of attacks studied were believed to be AI-generated, underscoring the technology’s dual role in cybersecurity. The study, conducted by the Ponemon Institute, analyzed 602 global organizations between March 2025 and February 2026, with follow-up interviews in May 2026. While the findings provide a snapshot of evolving threats, the methodology based on online surveys lacks a traditional margin of error due to non-random sampling.

Telus Investigates Cybersecurity Breach Amid System Hack Telus Corporation, one of Canada’s largest telecommunications providers, is actively investigating a hack of its systems, the company confirmed. The breach was disclosed amid growing concerns over cybersecurity threats targeting critical infrastructure. While details remain limited, the incident highlights the ongoing risks faced by major corporations in safeguarding sensitive data. Telus, headquartered in Vancouver, has not yet released specifics on the scope of the breach, potential data exposure, or the methods used by attackers. The investigation comes as cyber threats continue to escalate, with high-profile breaches affecting industries from healthcare to finance. No further information on the timeline or impact has been provided, but the company is likely working with cybersecurity experts to assess and mitigate the fallout. As of now, Telus has not indicated whether customer or employee data was compromised, but the incident underscores the persistent challenges in defending against evolving cyber threats. Further updates are expected as the investigation progresses.