I received the email below generated by a threat actor who has breached Hiccup / Prosura. I used Prosura 2 years ago to buy a rental vehicle excess insurance policy.

Email appears to be one that would be automatically generated after making a modification to the policy, which it appears the threat actor has done by adding his message. The rest of the email included the policy number, my full name, period of insurance, premium charged, date of original transaction and clickable links to "manage policy" and "view invoice". URL's for those links match the urls in the orginal transaction email I received at time of taking out the policy.

As far as I can tell the breach appears genuine. Unsure if credit card info has been compromised.

No communications received from Prosura who are based in Australia.

 

from: Prosura <policies@prosura.com>
reply-to: Prosura <help@prosura.com>
to:  

 

date: 3 Jan 2026, 19:07

 

subject: Modification: Rental Vehicle Excess Insurance - Policy VROOM-RVENZ00000

 

mailed-by: awsses-ap-southeast-2.prosura.com

 

Signed by: prosura.com security:  

 

Standard encryption (TLS) Learn more

 

 

 

Please read this message closely. 

 

On 01/01/2026, Hiccup / Procura was hit by a data breach that not only crippled its systems but also leaked all consumer information, including full names, email addresses, phone numbers, invoices, and much more. I (the threat actor) attempted to reach out to Hiccup to try to patch this issue and possibly claim a bug bounty.

 

What brings me back to this exploit today is the fact that they have completely ignored my message and left the vulnerability open, which is insane. To the Hiccup / Prosura HR team: you must contact xxxxxxxx@proton.me to get this sorted. I'm done playing this game with you. We need to get this resolved, or everything will be leaked and ended here.

 

Now this is a direct message to you, the consumer, regardless of what happens next. Your trust has already been broken - your information was put at risk due to ignored security practices, and the company failed to act even after being warned. I am currently trying to reach an agreement with the Hiccup / Prosura team to resolve this and ensure the data does not leak.