TL;DR: ShinyHunters breached Canada Life Assurance Company through a compromised employee account, claiming access to 5.6 million Salesforce records. Canada Life confirmed up to 70,000 customers were affected: names, birth dates, addresses, gender, and income levels exposed. The group set a "pay or leak" deadline of April 21, 2026. This is the same crew that just dumped McGraw-Hill, hit Carnival, and is running through Salesforce-connected companies like a checklist. If you're a Canada Life customer, your insurer just became a data liability.
One Employee Account. 5.6 Million Records.
On April 17, 2026, ShinyHunters posted on their dark web leak site claiming to have breached The Canada Life Assurance Company. They said they had 5.6 million Salesforce records containing personally identifiable information. They gave Canada Life until April 21 (today) to pay up or watch it all go public [1].
Canada Life confirmed the breach to The Globe and Mail on April 21. The company said the attack came through "a Canada Life employee's account" and that the incident was identified "over the past two weeks" [2]. They say it's been contained. They say regular operations continue.
What they haven't said: how ShinyHunters got the employee's credentials. Whether it was phishing, vishing, or credential stuffing. How long the attackers had access before anyone noticed. Or whether 5.6 million records is the real number, or just what ShinyHunters chose to count.
What Got Stolen
Canada Life confirmed up to 70,000 customers were directly affected, less than 0.5% of their 14 million total customers. The majority of compromised accounts belonged to employees of a single large corporate client [2].
The exposed data includes:
- Full names
- Dates of birth
- Mailing addresses
- Gender
- Annual income levels
That last one is worth pausing on. Your income level. The kind of data that most people only share with their employer, their bank, and their insurer. Now it's in ShinyHunters' hands.
Canada Life says it's "still investigating whether additional data types were accessed." Translation: they don't know the full scope yet. They're telling you the best-case scenario while they figure out how bad it actually is.
Meanwhile, ShinyHunters claims 5.6 million records. Canada Life says 70,000 customers. That's a gap of about 5.53 million. Either ShinyHunters is inflating numbers to pressure future victims, or Canada Life is counting "affected customers" very narrowly while ignoring the broader dataset that was accessible through Salesforce.
The April 21 Deadline and the Eight-Company Hit List
Canada Life isn't the only company sweating today's date. ShinyHunters posted eight companies on their leak site in rapid succession last week, all with an April 21, 2026 deadline [3]:
Carnival Corporation
Cruise line giant. ShinyHunters claims 8.7 million records stolen through a phishing attack on a single account [4].
Zara
Fashion retailer. Linked to the Anodot-Snowflake breach wave that also hit Rockstar Games [3].
7-Eleven
Convenience chain. Pulled into ShinyHunters' Salesforce-focused access campaign [3].
Medtronic & Pitney Bowes
Medical devices and shipping tech. Also on the April 21 list. Breach scope unconfirmed [3].
This is assembly-line extortion. ShinyHunters finds a way in (usually through Salesforce, Snowflake, or SSO misconfigurations) extracts data, sets a deadline, and moves to the next target. If you don't pay, they dump. If you do pay, they still might dump. There's no honor among data thieves.
The Salesforce Problem, Again
Canada Life's Salesforce records join a growing pile. In the last two months alone, ShinyHunters has hit:
- McGraw-Hill: 13.5 million records via Salesforce misconfiguration
- TransUnion: credit bureau breached through Salesforce supply chain
- 400+ companies via Salesforce-connected tools
- CarGurus: 12 million records via Salesforce vishing
The pattern is identical every time. ShinyHunters doesn't hack Salesforce. They hack how companies use Salesforce. Over-permissioned integrations. Stolen employee credentials that grant API access. Community portals left open. Sharing rules nobody reviewed since initial setup.
Salesforce has 150,000+ customers. Most set up their instances years ago. ShinyHunters is betting that the misconfigurations outnumber the companies that've audited their setups. Based on the hit rate so far, that's a safe bet.
Why Insurance Data Is Especially Dangerous
Insurance companies hold a uniquely invasive dataset. They know your health conditions, your income, your dependents, your address, your age. This isn't like an email list leak. This is the kind of data that enables:
- Targeted social engineering: "Hi, this is Canada Life calling about your benefits plan. We just need to verify your SIN..."
- Insurance fraud: filing claims using stolen identity data
- Employment discrimination: income data + employer group affiliation reveals which company you work for and what you earn
- Identity theft: name + DOB + address is the starter kit
Canada Life says no financial account data was compromised. Good. But your name, birthday, home address, and salary bracket? That's enough to impersonate you to a bank, a phone company, or another insurer.
What to Do If You're a Canada Life Customer
Watch for Phishing
Scammers now know your name, address, and that you're a Canada Life customer. Any email, text, or call claiming to be from Canada Life should be treated with suspicion. Don't click links. Go directly to canadalife.com.
Freeze Your Credit
Canadian residents can place a fraud alert with Equifax Canada (1-800-465-7166) and TransUnion Canada (1-800-663-9980). With name + DOB + address exposed, credit fraud is a real risk.
Take the Free Monitoring
Canada Life is offering complimentary credit monitoring to affected clients. Sign up when they contact you, but don't rely on it as your only protection.
Check Your Benefits Portal
Log into your Canada Life account and check for unauthorized changes to beneficiaries, contact information, or direct deposit details. Change your password while you're there.
ShinyHunters Isn't Slowing Down
This is at least the 25th major breach attributed to ShinyHunters in 2026. They've hit education companies, financial services, healthcare providers, game studios, cruise lines, and now insurance companies. The common thread isn't the industry. It's Salesforce, Snowflake, Okta, and other cloud platforms that companies configure once and forget about.
Canada Life joins Telus Digital, CIRO, and Canadian Tire on the growing list of Canadian companies breached this year. The country's privacy commissioner is going to have a busy quarter.
If your company uses Salesforce: audit your configurations today. Check API permissions. Review employee access levels. Run the Salesforce Health Check. Because ShinyHunters is running through their target list faster than companies can patch their mistakes, and your name might be next.
References
- HookPhish - Ransomware Group ShinyHunters Hits Canada Life Assurance Company (April 2026)
- The Globe and Mail - Hackers accessed personal information for up to 70,000 people in Canada Life data breach (April 21, 2026)
- Cybernews - ShinyHunters adds Zara, Carnival, 7-Eleven to growing ransomware leak list (April 2026)
- Cyber Insider - Carnival Corporation probes data breach after claims of 8.7M records theft (April 2026)