Promutuel Insurance has kept brokers and firms in the dark, whose names appear in documents published on the dark web. No report was provided either to the privacy commissioners of Quebec and Canada.
• Read also: Data stolen from Promutuel ends up online
Since December, several IT systems at Promutuel have been paralyzed. The newspaper revealed this week that in early January, confidential documents had been posted online.
The company confirmed our information, adding that “the 15 files” leaked did not contain any social insurance number, driver’s license, credit card number or other banking information.
The insurer says it has recovered these documents today.
Joined by The newspaper, several brokers and brokerage firms, whose names appear in documents or emails published online confirmed, Wednesday and yesterday, that they had not been informed by Promutuel of this information leak.
In recent days, the Quebec insurer had not wanted to say if he had contacted the individuals involved in this incident.
Promutuel replied that “the regulatory authorities are already informed of the situation and [que] the police were also seized of the case ”.
On Wednesday, the spokesperson for the Quebec Access to Information Commission stressed that her organization had not had an exchange with the insurer.
“We have not received an incident report from Promutuel,” said Isabelle Gosselin. “In some cases, it sometimes takes time to be informed,” she added, adding that her troops will soon assess whether there is material to open an investigation.
The response was the same from the Office of the Privacy Commissioner of Canada. “We have not received an incident report from the organization,” replied spokesperson Anne-Marie Cenaiko.
The Autorité des marchés financiers, however, was notified by the grouping of mutuals in December, during the cyberattack.
Currently in Quebec, a company is not required to publicly disclose a theft of personal information or a security incident. She is also not required to notify the commissioners. Bill 64, however, provides for a modification to this practice.
Yesterday, it was not possible to speak to a manager at Promutuel.
UPA is concerned
As for the Union des producteurs agricoles (UPA), several members of which are insured with Promutuel, management is concerned about this cyberattack and is trying to obtain clarification from the insurer.
“We hope that the consequences will be limited for our producers in Quebec,” noted communications manager Jessica Blackburn.
– With the collaboration of Hugo Joncas, Bureau of investigation