--- title: "Canada Life employee-account data incident" description: "Evidence-backed account of Canada Life employee-account data incident, covering what happened, impact, timeline, attack vector, technical details, and primary sources." incident_type: "Data incident" status: "active" last_modified: "2026-08-09" canonical_url: "https://www.ally.security/incidents/canada-life-employee-account-data-incident-2026" markdown_url: "https://www.ally.security/incidents/canada-life-employee-account-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/canada-life-employee-account-data-incident-2026/stix.json" --- # Canada Life employee-account data incident Canada Life identified unauthorized access to certain applications through an employee account. The HIBP corpus associated with the incident contains contact, professional, and support-ticket data. Last modified Aug 9, 2026 · 2 sources ## Summary - **Environment:** Not publicly identified - **Operational impact:** No outage or recovery duration quantified - **Financial impact:** No public cost estimate ## What happened [Canada Life](https://www.canadalife.com/) identified unauthorized access to certain applications through an employee account. [2](#source-2) ## Impact The HIBP corpus associated with the incident contains contact, professional, and support-ticket data. [1](#source-1) Documented data types include: - Employment information — Job titles listed for the HIBP incident corpus. [1](#source-1) - Contact information — Email addresses, phone numbers, and physical addresses listed for the HIBP incident corpus. [1](#source-1) - Customer service records — Support tickets listed for the HIBP incident corpus. [1](#source-1) - Names — Names and salutations listed for the HIBP incident corpus. [1](#source-1) A cited record reports 237,810 records (Unique email addresses represented in the HIBP incident corpus; a corpus-record count, not Canada Life's customer-impact count; as of 2026-05-13). [1](#source-1) Canada Life's public assessment was that a small proportion of its customers may have been impacted; it did not publish an exact count in that statement. [2](#source-2) ## Timeline ### April 20, 2026 — Documented event Incident date in the HIBP corpus; Canada Life's public statement does not give a precise access timestamp or duration. [1](#source-1) ### April 20, 2026 — Public disclosure Publication date of Canada Life's public cyber-incident statement. [2](#source-2) ### August 9, 2026 — Briefing updated This briefing was last reviewed and updated on August 9, 2026. ## Threat Group & Attack Vector Canada Life reported unauthorized access to certain applications through an employee account. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Canada Life said it contained the incident, launched an immediate investigation with leading third-party cybersecurity experts, and notified authorities. Canada Life said affected people would be contacted directly and offered no-cost credit monitoring protection. Canada Life said regular operations and services continued after containment. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Canada Life breach record advisory · Have I Been Pwned · May 13, 2026 ### Canada Life recently identified a cyber incident official · The Canada Life Assurance Company · Apr 20, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** April 2026 Canada Life employee-account incident: Canada Life reported unauthorized access to certain applications through an employee account. 2. **Affected Organization · 100% confidence · current** April 2026 Canada Life employee-account incident: The Canada Life Assurance Company 3. **Resulted In · 100% confidence · current** April 2026 Canada Life employee-account incident: Canada Life customer and contact data exposure 4. **Exposed Data Category · 100% confidence · current** Canada Life customer and contact data exposure: Employment information 5. **Resulted In · 100% confidence · current** April 2026 Canada Life employee-account incident: Canada Life said it contained the incident, launched an immediate investigation with leading third-party cybersecurity experts, and notified authorities. 6. **Resulted In · 100% confidence · current** Canada Life April 2026 incident disclosure and customer notification: Canada Life said affected people would be contacted directly and offered no-cost credit monitoring protection. 7. **Exposed Record Count · 100% confidence · current** Canada Life customer and contact data exposure: 237,810 record 8. **Affected Organization · 100% confidence · current** Canada Life customer and contact data exposure: The Canada Life Assurance Company 9. **Occurred At · 90% confidence · current** April 2026 Canada Life employee-account incident: 2026-04-20 10. **Resulted In · 100% confidence · current** April 2026 Canada Life employee-account incident: Canada Life April 2026 incident disclosure and customer notification 11. **Exposed Data Category · 100% confidence · current** Canada Life customer and contact data exposure: Contact information 12. **Disclosed At · 100% confidence · current** Canada Life April 2026 incident disclosure and customer notification: 2026-04-20 13. **Resulted In · 100% confidence · current** April 2026 Canada Life employee-account incident: Canada Life said regular operations and services continued after containment. 14. **Resulted In · 100% confidence · current** Canada Life customer and contact data exposure: Canada Life's public assessment was that a small proportion of its customers may have been impacted; it did not publish an exact count in that statement. 15. **Exposed Data Category · 100% confidence · current** Canada Life customer and contact data exposure: Customer service records 16. **Exposed Data Category · 100% confidence · current** Canada Life customer and contact data exposure: Names