How a cyberattack on a Canadian insurance courier affected brokers and carriers

Some Canadian brokerages and insurers recently experienced delays in mail pick-up and delivery after a prominent courier service for the Canadian insurance industry suffered a cyberattack.

ICS Courier confirmed in a message on its website Monday that it was the target of a ransomware attack Aug. 19 that impacted “some” of its systems. “We continue to meet most shipping needs and we are not aware of any misuse of client information,” noted a screenshot of the website obtained by Canadian Underwriter. “Out of an abundance of caution, we want to make our clients aware of the incident, should you be experiencing any issues.”

Miki Paczek, manager of sales and distribution with The Commonwell Mutual Insurance Group, said Tuesday she knew of brokerages in eastern Ontario that had not been getting any mail picked up or dropped off. There were also reportedly difficulties getting through to the courier or having messages returned.

The ICS website appeared back online Monday. “ICS Courier takes our obligation to protect customer information seriously,” the website said. “Upon learning of the incident, we immediately began an investigation and engaged cybersecurity experts to assist in the process. We have taken steps to contain and remediate the issue and are taking all necessary steps to help prevent a similar occurrence in the future.”

iStock.com/ lovro77

ICS could not be reached for additional comment by press time.

Paczek said ICS delivers everything from single, small envelopes up to parcels. She also uses the courier service to send boxes or other items to her brokers.

“Every company I have worked with uses ICS to send their paperwork to each other… whether insurance companies, body shops, brokerages, [or] anyone who regularly deals with the insurance industry,” Paczek said. “It is a service we all use and [the cyberattack] could have some ripple effect.”

Paczek said she has never encountered an issue with ICS to this extent before. “They are quietly in the background of what we do,” she said. “For me, where could have been an issue, and I raised it at my own company, is payments.”

Most payment processes are done electronically, but some of The Commonwell’s brokers get payments from clients and need to forward cheques and paperwork. “A ripple of [ICS] being out or slowed down could mean policies going NSF [non-sufficient funds]… and potentially being cancelled because people don’t realize it was service causing the delay,” Paczek said. “Also, Canada Post has been slower, too, so if they just pop things in the regular mail, it could be later.”

Paczek said a few brokers reached out to ask why they didn’t receive any mail or get mail picked up. “A lot of confused people out there,” she said. “I think the industry should be made aware. Also, could it happen again? Do we need to have back-up plans in place, look at other vendors, etc.?”

Curtis Killen, president of Quebec brokerage KBD Insurance, was one of the brokerages not affected by the cyberattack. KBD offers online bank deposits and wire transfers; it doesn’t send out cheques anymore.

“Fortunately, we were not affected,” Killen said Wednesday, adding that Quebec has less regulation than other provinces surrounding insurance payments. “We went paperless a while ago. We did a huge cyber prevention analysis a few years back; hopefully, we won’t have to deal with something like this anytime soon.”

Feature image via iStock.com/AndreyPopov

Editor’s Note: This story continues to develop and more information will be added as is becomes available.