Hub privacy breach affects “limited” amount of Canadian data

Hub International Limited, a Chicago-based brokerage with offices in 10 Canadian provinces and territories, has reported a privacy breach of data related to “a limited number of Canadians.”

Hub posted a “notice of a data privacy event” online on Friday, in which the company described the breach as a mainly U.S.-based event. A “limited” amount of data related to Canada, the brokerage confirmed in its notice.

“On Jan. 17, 2023, Hub identified suspicious activity on certain systems within our network,” the notice read. “In response, we promptly isolated the impacted systems and commenced a forensic investigation.

“The investigation determined that certain portions of our network were accessed by an unknown individual and files were copied without authorization between December 2022 and January 2023.”

In a Q&A posted on the brokerage’s website, Hub confirmed the event was not a ransomware event. “Malware encrypted files were not identified during the investigation,” the brokerage stated.

Hub said no evidence of data misuse has been detected thus far. Those whose information has been affected will receive a letter in the mail, and the brokerage is offering monitoring services to affected individuals through Equifax.

Hub’s notice went on to say the data “contains information related to current and former employees, individuals for whom HUB places insurance policies, and individuals related to insurance carriers and employers to whom HUB provides services.

“The categories of data affected vary by individual, and include name, Social Security number, driver’s license number, passport number, financial account information, health insurance information, and medical information. Some of the data affected also relates to a limited number of Canadians.”

Related: Canadian businesses hit hard by data breach costs

Hub said its investigation is ongoing. It completed an initial investigation and began notifying clients and agencies on July 27, 2023. In the meantime, it has taken steps to secure the brokerage’s systems, train employees on the importance of data security, and notified law enforcement.

Hub is now working with its affected business partners and customers to provide notice to potentially affected individuals. Notice is also being provided to relevant regulatory authorities and credit reporting agencies.

Hub’s statement outlines six different steps Canadians may take if they believe their personal information has been misused. They include:

File a complaint with the police.
Contact the Canadian Anti-Fraud Centre at 1-888-495-8501. The national anti-fraud call centre is jointly managed by the Royal Canadian Mounted Police, Ontario Provincial Police and Competition Bureau Canada. They provide advice and assistance about identity theft.
Contact Canada’s two national credit reporting agencies, Equifax Canada and TransUnion. Ask for a copy of your credit report. Review it for any suspicious activity. Also check to see if your credit file should be flagged with a fraud alert (fees may be applicable).
Inform banks and creditors by phone and in writing about any irregularities.
Report any irregularities in your mail delivery to Canada Post, such as opened envelopes or missing financial statements or documents.
Visit a Service Canada office if there is any suspicion a social insurance number has been used fraudulently.

Feature image is courtesy of iStock.com/JuSun