Westland Insurance

The investigation team has indexed a dataset of more than 1.5 million records connected to Westland Insurance, a Canadian property and casualty insurance brokerage. The listing follows a claim by the Helix ransomware group, which added Westland Insurance to its leak site in early August 2026, saying it had stolen internal files during a ransomware attack. That claim has not been confirmed by the company.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

August 7, 2026: The Helix ransomware group listed Westland Insurance on its leak site, claiming it exfiltrated internal files and stating that ransom negotiations had stalled. The listing was tracked by ransomware.live and reported by dexpose.

August 17, 2026: A weekly threat intelligence report from OSec listed Westland Insurance among recent victims claimed by threat actor brands.

What Information Was Compromised?

Our analysis found the following data types in this breach: names for roughly 1.52 million people, about 1.31 million phone numbers, about 1.06 million email addresses, about 1.01 million dates of birth, about 1.04 million street addresses, about 127,000 vehicle identification numbers, about 3,300 vehicle license plates, 510 driver's licence numbers, and 7 Social Security numbers.

Not every individual is affected by every type of data listed here.

The Helix leak-site entry did not specify the volume or exact types of data taken, and no sample files were published, according to GalaxyWarden, which cautioned that the listing remains an unconfirmed claim by the attacker.

What Are the Potential Risks for Affected Individuals?

The combination of names, phone numbers, email addresses, home addresses, and dates of birth is well suited to targeted phishing and smishing attacks. Fraudsters can use this data to pose as an insurance company, a bank, or a government agency, and a date of birth plus an address is often enough to pass basic identity checks over the phone.

The vehicle identification numbers and license plates add another risk. A VIN can be used to obtain vehicle history reports, forge ownership documents, or make scam claims more convincing. Driver's licence numbers are more serious: combined with other personal details, they can support identity fraud. The very small counts for driver's licences and Social Security numbers suggest those fields apply to only a small subset of the records.

What Is Westland Insurance Doing in Response?

No public statement, breach notification, or regulator filing from Westland Insurance was found in sources reviewed as of September 25, 2026. GalaxyWarden reported that the company had not confirmed the incident as of its coverage, so any response the company may be taking is not publicly known.

What Should You Do If You Were Affected?

Be skeptical of unexpected calls, texts, or emails that reference your insurance policy, your address, or your date of birth. Do not share personal or financial details with anyone who contacts you first.

If you appear in this breach, consider changing passwords for your email and any accounts linked to it, and turn on multi-factor authentication where it is offered.

Watch your credit reports and bank statements for activity you did not authorize. In Canada, you can request a free credit report from Equifax and TransUnion and place a fraud alert if needed.

If you hold a policy with Westland Insurance and receive a direct notification from the company, follow its instructions, since the company may hold details beyond what is indexed here.