Canada Life breach: threat actor claims 5.5 million records now for sale

A threat actor known as ShinyHunters is claiming to sell a Canada Life database with more than 5.5 million records on an underground forum, according to researchers who reviewed a sample linked to the listing. The figure would significantly expand the scope of the original incident, although it remains unverified and sharply conflicts with the insurer’s confirmed exposure numbers. Cybernews reported that the dataset appears consistent with a Salesforce customer relationship management (CRM) environment, and that it looks legitimate at first glance, but cannot be independently confirmed at this stage. Canada Life was contacted for comment, including on the new claim. The update adds to an April incident in which Canada Life confirmed that ShinyHunters accessed personal information for up to 70,000 people via a single compromised employee account. Analysts describe this tactic as “extortion inflation,” where attackers overstate data access to pressure payments. Security experts say the pattern—compromising one credential, authenticating to Salesforce, then exporting records—does not exploit a flaw in Salesforce itself.