Cybersecurity for Canadian Insurance Companies

Cyber threats specific to Canadian insurance companies and brokers

• Insurance claims databases are among the most sensitive aggregations of personal information in the Canadian economy.
• A single property and casualty insurer's claims system contains home addresses, vehicle identification numbers, driver histories, health information from accident and disability claims, legal proceeding records, and financial data from settlements, often for millions of policyholders.
• Life and health insurers add benefit utilization, prescription records, and beneficiary information.
• This data has multiple downstream uses for threat actors: identity fraud, medical record manipulation, legal fraud, and targeted social engineering.
• Unlike financial account data, which can be changed after a breach, health history and legal records are permanent, making the harm from a health insurer breach durable in a way that a credit card breach is not.
• Business Email Compromise targeting insurance payment workflows is a documented and recurring threat.
• Insurers process large claim payments, broker commission disbursements, and reinsurance settlements on regular schedules, the payment patterns are predictable, the dollar amounts are large, and the workflows often involve external parties communicating via email.
• BEC actors compromise either the insurer's internal email accounts or vendor accounts, monitor payment communications, and insert fraudulent banking instructions at the moment a payment is being confirmed.
• RIBO-regulated brokers in Ontario, thousands of individuals and firms that handle premium payments and claims, are especially exposed because brokerage offices often lack the IT controls of a large insurer and are accessible through standard commercial email platforms with weak authentication.
• Broker Management Systems represent a specific single-point-of-failure risk in the Canadian broker channel.
• BMS platforms, Applied TAM, Acturis, Vertafore, and others, sit at the centre of every transaction a brokerage processes, containing policyholder data, certificate issuance authority, and in some cases direct API connections to insurer systems.
• A compromise of a BMS platform, whether at the broker level or at the software vendor level, can expose data across thousands of policyholders and create pathways into multiple insurer systems simultaneously.
• Several Canadian brokers have experienced ransomware attacks that encrypted their entire BMS database, leaving them unable to issue certificates, process renewals, or service claims during the recovery period, typically 5–15 days even with good backups.
• Ransomware timing in insurance mirrors the catastrophe response calendar.
• When a major weather event triggers a surge in property claims, ice storms in Ontario, flooding in BC or Alberta, hailstorms on the prairies, claims departments are working at maximum capacity with expanded vendor and adjuster access.
• Threat actors monitor these events and time attacks to coincide with catastrophe response periods when the cost of downtime is highest, IT staff are focused on supporting operational surge, and the pressure to restore systems quickly overrides security caution.
• The insurance industry's mutual aid response framework, which activates insurer resource-sharing during catastrophe events, also creates temporary access paths between organizations that are not part of the normal security perimeter.

Who regulates what in Canadian insurance