islandinsurance.ca Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When an insurance firm appears on a ransomware group's leak site, the people who matter most are the customers and staff whose details may sit inside the files the attackers say they took. Public reporting does not yet say how many people are involved or exactly which records left the network, but the listing alone is enough reason for anyone who has dealt with islandinsurance.ca to pay attention and take basic protective steps.

On 27 March 2023, the ransomware group known as lockbit3 listed islandinsurance.ca, claiming it had exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. What is clear is that any organisation handling insurance business routinely stores sensitive personal and financial information, so a claimed theft of internal files carries real stakes for those whose data may be among them.

What happened

According to the public record, islandinsurance.ca was listed by the lockbit3 ransomware group on 27 March 2023. The group claims that internal files were exfiltrated as part of a ransomware attack. No further verified detail has been released about the date the intrusion began, how the attackers gained access, whether systems were encrypted, or how large the stolen data set may be. The number of people affected is unknown. Beyond the leak-site listing itself, public sources have not confirmed additional technical findings or a formal disclosure from the organisation that would independently verify every element of the claim.

Inside lockbit3

LockBit 3.0, often shortened to lockbit3, is a well-documented ransomware operation that has appeared repeatedly in public reporting since its earlier incarnations. Like many contemporary ransomware groups, it has operated on a ransomware-as-a-service model, in which affiliates carry out intrusions and the core group supplies the encryptor, negotiation infrastructure, and a leak site used for pressure. The typical pattern associated with the group is double extortion: data is copied out of the victim network before encryption, and the operators threaten to publish the material if a ransom is not paid. Listings on the group's leak site are therefore claims made by the actors themselves; they are not independent proof of every asserted detail. LockBit has been linked over time to attacks across many sectors and countries, and law-enforcement actions have periodically disrupted its infrastructure, yet the brand and its tactics remain widely recognised in cybersecurity reporting. Nothing in the public facts about this specific incident goes beyond the group's claim that it listed islandinsurance.ca and exfiltrated internal files.

About islandinsurance.ca

Island Insurance is identified in available reporting as owned and operated by Gurpreet Khaira, Balwinder Khaira, and Harjinder Basra. Its staff are described as level 2 brokers with more than 50 years of combined experience in the insurance business. Firms of this kind sit in the insurance brokerage sector: they arrange cover for individuals and businesses, collect application and claims information, and maintain ongoing policy records. That work necessarily involves names, contact details, dates of birth, addresses, policy numbers, vehicle or property information, and often financial or payment data. Because insurance records can remain relevant for years, a breach affecting such an organisation can touch both current and former clients as well as employees. The consequential nature of an incident here stems less from any single headline and more from the ordinary sensitivity of the data an insurance brokerage must hold to do its job.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data types—such as customer names, policy documents, claims files, employee records, or financial details—has been publicly confirmed. Organisations in the insurance brokerage sector typically retain precisely those categories of information in order to quote, bind, and service policies. It is therefore reasonable for people who have dealt with the firm to assume that personal and policy-related material could be among internal files, yet it remains unconfirmed what exactly left the network. Readers should treat any more granular description as speculative until official or independently verified detail appears.

The real-world impact

For individuals, the practical risks are familiar rather than dramatic. If personal identifiers, contact information, or policy documents were among the taken files, those details can be used in targeted phishing, social-engineering calls that reference a real policy, or attempts to open new accounts. Insurance-related data can also help criminals craft convincing fraud around claims or renewals. Because the number of people affected is unknown and the exact contents unconfirmed, the scale of that exposure cannot be stated with precision; the prudent assumption is that anyone who has been a client or employee should remain alert. For the organisation, a public ransomware listing brings operational disruption, potential regulatory scrutiny, notification obligations, and lasting questions of trust from customers who entrust it with sensitive information. None of these outcomes require the attackers to have published every file; the credible threat of publication is often enough to create lasting cost and uncertainty.

What to do if you're exposed

If you have been a customer, claimant, or staff member connected with islandinsurance.ca, begin with simple, high-value steps. Monitor bank and credit-card statements and any insurance-related accounts for unfamiliar activity. Treat unexpected emails, texts, or calls that reference your policy or personal details with caution; verify through a known official channel rather than replying or clicking links. Consider placing fraud alerts or credit freezes with the major credit bureaus if you believe sensitive identifiers may have been involved. Change passwords on related accounts and enable multi-factor authentication where it is offered. Keep records of any suspicious contact. Finally, you can run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets; that check is a practical complement to the steps above and helps you decide whether further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.