4 Canadian courier divisions of TFI International's Canpar Express Listed by doppelpaymer Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 19, 2020, four Canadian courier divisions operating under TFI International’s Canpar Express appeared on a leak site maintained by the doppelpaymer ransomware group. Public records show only that the group listed the divisions and claimed to have taken internal files; no confirmation of the data’s contents, volume, or subsequent distribution has been released, and the number of individuals affected remains unknown. This listing occurred at a time when ransomware operators were increasingly combining encryption with the threat of data publication, a tactic that had already affected logistics and transportation firms in multiple countries. The incident illustrates how even regional operating units of larger transport companies can become visible targets when threat actors seek leverage through public disclosure.

What happened

The four courier divisions were added to the doppelpaymer leak site on 19 August 2020. The only information made public at the time was the group’s assertion that internal files had been removed during a ransomware intrusion. No ransom demand amount, encryption details, or proof-of-exfiltration samples were disclosed in available reporting, and the company has not published an official statement confirming or denying the claims.

Who is doppelpaymer?

Doppelpaymer is a ransomware operation documented since 2019 that typically deploys custom encryption malware and maintains a leak site to pressure victims. Public reporting on the group describes a pattern of initial network access followed by data collection and, in some cases, publication of files when negotiations stall. The group’s listings are treated as unverified claims until independently confirmed by the affected organisation or law enforcement.

4 Canadian courier divisions of TFI International's Canpar Express and its sector

The affected units form part of Canpar Express, a Canadian courier network owned by TFI International. Such divisions routinely manage parcel collection, sorting, and delivery across domestic routes, which requires the processing of shipment records, customer addresses, and internal operational documents. Transportation and logistics organisations hold data that can reveal supply-chain relationships and individual movement patterns, making any confirmed exfiltration a matter of interest to both regulators and the individuals whose parcels were handled.

What was likely exposed

The only detail released is that internal files were claimed to have been exfiltrated. No inventory of file types, customer records, or employee information has been published. Organisations of this kind commonly store names, addresses, shipment identifiers, and billing details; however, whether any of these categories were among the files listed by the group is unconfirmed.

The real-world impact

Individuals whose information appears in courier records could face increased risk of targeted phishing or physical-mail fraud if the files contain contact details. For the divisions themselves, the listing creates uncertainty for business partners and may prompt reviews of third-party data-sharing agreements. Because the scale of exposure is unknown, the practical consequences for any specific person or organisation cannot yet be quantified from public sources.

Were you affected?

Recipients of parcels handled by the four divisions have no public notification channel at this time. A practical first step is to monitor statements from TFI International or Canpar Express and to review bank and delivery accounts for unusual activity. Individuals may also submit their email addresses to established breach-notification services that aggregate known data leaks, though such scans will not capture files that have not been publicly indexed.

AICompiled with AI assistance from public sources and published under our editorial standards.