Cybersecurity | Promutuel Insurance does not reassure anyone

The consequences of the computer security crisis that has been raging for more than a month at Promutuel Insurance continue to cause concern in the property and casualty insurance industry in Quebec despite the few bits of information that the insurer has managed to offer its customers. customers in recent days on its website, in very minimal operation, and through its Facebook page.

Martin Vallieres
Press

“We are monitoring the situation closely at Promutuel, especially since computer security is an issue that is taken very seriously in the insurance sector,” says Pierre Babinsky, director of communications at the Insurance Bureau of Canada ( BAC), which represents damage and liability insurers.

“When an insurer is affected by a cyberattack, it is very important that it take all the measures it deems necessary with its specialists [en sécurité informatique] to ensure the integrity and security of its network, and to protect its customers’ data.

“An insurer affected by a cyber attack must take steps to restore and maintain essential services to its customers,” adds Mr. Babinsky. It is its responsibility to be able to respond to policyholders in the event of a claim, with priority placed on more serious claims which, for example, prevent policyholders from using their vehicle or living in their residence. ”

In the case of Promutuel Insurance? “We received a few calls to our information center from Promutuel customers who were inconvenienced by the situation, and who we directed to the insurer’s information contacts for specific follow-up,” said Mr. Babinsky.

“In the meantime,” he continues, “the information posted on Promutuel’s website should serve to reassure customers that their insurance protection remains valid and that measures have been taken towards a possible return to normalcy. ”

The Regroupement des cabinets de brokerage assurance du Québec (RCCAQ), which brings together some 3,000 brokers in 400 offices, has reported a continuity of information “satisfactory under the circumstances” from Promutuel since the start of this major failure of computer systems.

“Contrary to what seems to be perceived among policyholders in direct sales.” [sans courtier], the insurance brokers who do business with Promutuel did not feel left out. They continued to have access to their client’s account and insurance contract information at Promutuel, ”says Mathieu Brunet, Chairman of the Board of Directors of the RCCAQ and director of a brokerage firm in Laval.

AMF, Access to Information Commission

Nonetheless, at the Autorité des marchés financiers (AMF), the main regulator of the insurance sector in Quebec, it is indicated that “the situation prevailing at Promutuel has caused a few calls for questions and requests for information to our assistance service ”. Sylvain Théberge, main spokesperson for the AMF, adds: “Our monitoring of the situation at Promutuel remains very tight because the Authority is very aware of the impacts that this can have on the insurer’s clientele”.

“This is a very serious situation in which the Authority quickly set up discussions with Promutuel in order to ensure that the required follow-ups are carried out, that services can be restored as soon as possible and that the members [de la mutuelle] and customers are protected. ”

During this time, at the Quebec Access to Information Commission, responsible for the application of the Act respecting the protection of personal information in the private sector, we tell Press to be “very concerned about what is happening at Promutuel”.

In the absence of an “information security incident declaration” from Promutuel, the Commission established specific contacts with the insurer’s management in order to “find out whether the situation is under control and whether the affected people [par une fuite de leurs renseignements] have been notified, ”explains Isabelle Gosselin, Commission spokesperson.

The Commission is checking whether Promutuel is able to “limit the damage” resulting from this IT security situation, while “ensuring that a similar event does not occur again. ”

Remember that following the massive leak of personal information from millions of Desjardins Group clients, uncovered in June 2019, the Commission carried out a special investigation which resulted in a report last December that severely blames the giant. cooperative financier for “administrative and technological gaps” in its management of IT security.