Morison Insurance Brokers Listed by sinobi Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 27, 2026, reports indicated that Morison Insurance Brokers had been listed on a site associated with the sinobi ransomware group. The listing stated that internal files had been exfiltrated during a ransomware attack. No information has been released on the number of individuals affected or the volume of data involved. This development occurs against a backdrop in which ransomware operators routinely publicise corporate victims to pressure organisations into payment. Insurance brokers routinely process personal and financial details, making any confirmed exfiltration a matter of direct interest to policyholders and regulators.

What happened

Public reporting on the incident is limited to the group’s listing of Morison Insurance Brokers. The entry asserts that files were removed from the organisation’s systems. No official statement from Morison Insurance Brokers, no law-enforcement bulletin, and no independent confirmation of the data volume or encryption status have been published. The date the files were allegedly taken and the method of initial access remain undisclosed.

The group behind it: sinobi

Sinobi is a ransomware operation that follows the common pattern of encrypting victim systems and threatening to publish stolen data if a ransom is not paid. The group maintains a leak site where it lists organisations it claims to have targeted. Such listings serve as both a pressure tactic and a signal to other potential victims. Public records show the group has appeared in multiple incidents involving mid-sized companies, though independent verification of each claim is often unavailable.

Who is Morison Insurance Brokers?

Morison Insurance Brokers operates in Ontario and provides home, auto, and commercial insurance products. The firm handles policies for individuals and businesses, including higher-value home and vehicle coverage. Like other brokers in the sector, it collects and stores client identification, policy details, claims history, and payment information to underwrite and service contracts. A breach at such an entity therefore touches both personal data and records that can affect ongoing insurance coverage and claims processes.

What was likely exposed

The only data category named in available reports is “internal files exfiltrated in ransomware attack.” No inventory of specific file types, client records, or database extracts has been released. Organisations of this type typically retain names, addresses, policy numbers, driver’s licence details, claims documentation, and banking information used for premium payments. Whether any of these categories were among the files referenced in the listing is unconfirmed.

The real-world impact

Individuals whose information appears in insurance records face the standard risks associated with exposure of identity and financial data: potential misuse for fraud, targeted phishing, or identity theft. For the organisation, the incident may trigger regulatory notification requirements under Ontario and Canadian privacy law and could affect relationships with insurers and clients. The absence of Reported Details on the scale of exposure means the full extent of these consequences cannot yet be assessed.

If your data was in this claimed breach

Monitor statements from Morison Insurance Brokers and any official notifications that may follow. Review bank and credit-card statements for unauthorised activity and consider placing fraud alerts with credit-reporting agencies. Individuals can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published leaks.

AICompiled with AI assistance from public sources and published under our editorial standards.