Cyber Incident Forces Australian Insurer Prosura to Shut Down Key Systems

Australian car rental insurer Prosura said it suffered a major data security incident that forced the company to take several systems offline, disrupting its routine daily operations.

 

Prosura is a global insurance intermediary specialising in products such as Rental Vehicle Excess insurance, operating under the Hiccup brand in Australia and New Zealand and selling coverage through its affiliated comparison site, VroomVroomVroom.

 

In a data security incident notice published on its website, Prosura said that on 3 January, it identified suspicious activity within its internal network. The insurer immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It has also notified the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC) and said it will notify any regulatory bodies in accordance with its obligations.

 

“Based on our investigation to date we believe that some information related to customer policies and claims may have been impacted,” Prosura said. 

 

The compromised data included names, contact information, drivers’ licences and related images, travel destinations, invoicing and pricing data, and policy start and end dates. 

 

Prosura, as a precautionary measure, has temporarily taken several website functions offline, including the ability to purchase policies, submit or manage claims, and administer existing policies through its self-service portal. During this outage, it is conducting an urgent review of its systems and implementing additional security measures to prevent a recurrence.

 

In a statement shared with the ABC, Prosura founder Mike Boyd said, “The individual or individuals responsible have engaged in aggressive tactics to apply pressure on our business, including contacting some customers directly.

 

“We ask that all customers please not respond to any email, telephone or text messages that seem suspicious. We are working to ensure that all appropriate action is taken in response to this incident. To protect the integrity of our investigation and response, we cannot provide further information on this at this time,” he added.