Skip to content
Breach Index · running record

Manulife and John Hancock data breaches (2016-2026): Signator, the DG3 and Infosys McCamish vendor hacks, and the Qilin claim

Manulife is the Canadian parent of John Hancock in the US. Its public record over ten years is mostly about vendors and affiliates: a 2017 intrusion at John Hancock’s then broker-dealer Signator, two 2023-2024 vendor attacks named in US lawsuits, a 2023 whistleblower story about a Manulife Bank database, and an unconfirmed 2026 ransomware claim.

Short answer

Was Manulife or John Hancock hacked?

Partly, and mostly through others. In 2017 Signator Investors, then John Hancock’s broker-dealer, told clients an unknown third party had accessed client records from as early as June 2017, including Social Security numbers and account balances. In 2023 and 2024, two vendors were hacked: Infosys McCamish Systems, which provided insurance platform services to John Hancock, and DG3 North America, a print-and-mail vendor whose breach led to a lawsuit and a $600,000 settlement naming John Hancock Investment Management.

On 23 April 2026 the Qilin ransomware group listed “Manulife Wealth” on its leak site. That is a claim; we found no statement from Manulife confirming it. We found no confirmed hack of Manulife’s or John Hancock’s own core systems in the sources we read.

Timeline at a glance

  1. Jun - Aug 2017Signator Investors (John Hancock broker-dealer) finds unauthorized access to client records. (California AG notice)Confirmed
  2. 3 Apr 2023Insider tells CBC Manulife Bank’s “Databarn” lacked protections; Manulife denies a breach. (CBC)Unverified claim
  3. 29 Oct - 2 Nov 2023Ransomware at Infosys McCamish, a John Hancock platform vendor; class action filed 2024. (Bloomberg Law)Reported
  4. 5-22 Feb 2024Data copied from print vendor DG3; John Hancock Investment Management sued alongside DG3. (Bloomberg Law)Reported
  5. Jul 2025$600,000 DG3 settlement; about 53,227 people notified. (ClassAction.org)Reported
  6. 23 Apr 2026Qilin lists “Manulife Wealth” on its leak site. Manulife has not confirmed. (ransomware.live)Unverified claim

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Manulife / John Hancock incident timeline, in detail

Confirmed = acknowledged by Manulife / John Hancock, a regulator filing or a court. Reported = credible reporting Manulife / John Hancock has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Apr 2026Unverified claimLeak-site claim

Qilin ransomware group lists “Manulife Wealth” on its leak site

What happened. Ransomware.live, which tracks leak sites, recorded a Qilin listing for “Manulife Wealth” (manulifewealth.ca, Canada, financial services) on 23 April 2026. No data sample or volume was described in what we read.

Impact. Unconfirmed. We found no statement from Manulife and no regulator filing. Treat it as a claim until Manulife says otherwise.

Sources: ransomware.live listing, 23 Apr 2026

Feb 2024 - Jul 2025ReportedThird-party / print and mail vendor

Print-and-mail vendor DG3 hacked; John Hancock Investment Management sued alongside it

What happened. DG3 North America’s notice says it found suspicious activity on 19 March 2024 and that data was accessed or copied between 5 and 22 February 2024. DG3 prints and mails for a number of companies; its template leaves the client name blank. Bloomberg Law reported a proposed class action against John Hancock Investment Management LLC and DG3 over the breach, which affected investors’ data. This was DG3’s system; DG3’s notice says its clients’ systems were not affected.

Impact. The notice lists name, address, email address and account number. The settlement, per ClassAction.org, covered about 53,227 people notified, about 25,852 of them with Social Security numbers exposed, and investment fund information. The case (Cunningham v. DG3 North America, D.N.J. No. 2:24-cv-07385) settled for $600,000; claims closed 25 September 2025.

Sources: DG3 notice template (California AG), Jul 2024 · Bloomberg Law, 1 Jul 2024 · ClassAction.org, 15 Jul 2025

Oct 2023 - Sep 2024ReportedThird-party / insurance platform vendor

Infosys McCamish ransomware: John Hancock Life sued over vendor attack

What happened. Infosys McCamish Systems, which Bloomberg Law describes as providing “insurance platform solutions” to John Hancock, was hit by ransomware between 29 October and 2 November 2023. In September 2024 a proposed class action was filed against John Hancock Life Insurance Co. in Massachusetts federal court (No. 24-12383). Infosys was not a named defendant.

Impact. The suit cites more than six million people, which is the vendor-wide total across all Infosys McCamish clients, not a John Hancock figure. Data included Social Security numbers. We found no John Hancock-specific count.

Sources: Bloomberg Law, 19 Sep 2024

Apr 2023Unverified claimInternal data governance allegation

Whistleblower says Manulife Bank’s “Databarn” exposed customer data internally; Manulife denies a breach

What happened. CBC Go Public reported that an insider said Manulife Bank of Canada kept customers’ social insurance numbers, credit card and account details in a database called “Databarn” with weak protections for nearly a decade, reachable by more than 100 employees, and that a 2021 internal report flagged it. Manulife said the database “meets or exceeds regulatory requirements for privacy,” denied any breach of security safeguards and said there was “never any evidence” customer data was misused.

Impact. No external breach was alleged or confirmed. The story is about internal access controls, which Manulife disputes.

Sources: CBC Go Public, 3 Apr 2023

Jun - Aug 2017ConfirmedUnauthorized access to client records

Intrusion at Signator Investors, then John Hancock’s broker-dealer

What happened. Signator Investors’ notice says that on 23 August 2017 it determined an unknown third party had gained unauthorized access to certain client records, some as early as June 2017. It contained the intrusion, reported it to law enforcement and brought in outside experts. InvestmentNews reported in June 2018 that Signator was owned by John Hancock Financial Services, which agreed to sell it to Advisor Group that year.

Impact. The notice lists name, address, date of birth, Social Security number, phone, email, product account numbers and account balances, and offered 24 months of Experian identity services. The number of people was not in the template.

Sources: Signator notice template (California AG), 2017 · InvestmentNews, 21 Jun 2018 (ownership)

Where the reports disagree

  • Six million or 53,000? The two John Hancock lawsuits concern different vendors. “More than six million” is the Infosys McCamish total across all its clients; about 53,227 is the DG3 total across DG3’s clients. Neither is a John Hancock-only figure.
  • DG3 dates: DG3’s notice says data was taken 5-22 February 2024; ClassAction.org gives a window of 30 January to 19 March 2024. We use DG3’s notice.
  • Philippines: search results (we could not open the documents) describe Philippine National Privacy Commission orders concerning a 2019 disclosure by Manufacturers Life Insurance Co. (Phils.). Not verified, so not listed as an incident.

The pattern across the record

The exposure sits with service vendors

A print-and-mail house and an insurance platform provider each held John Hancock customer data with Social Security numbers. In both cases the lawsuits named John Hancock, not only the vendor.

Affiliates and brands blur the record

Signator, John Hancock Investment Management, John Hancock Life and Manulife Wealth are separate entities. Check which one a notice or claim names before assuming it covers your account.

What it means for Manulife / John Hancock customers — and what to do

If you hold John Hancock funds, life insurance or a Manulife account, the realistic risk is identity fraud from a vendor leak and scams that quote your account details.

  1. 1.Check which company sent your letter

    DG3, Infosys McCamish and Signator letters all relate to John Hancock but list different data. Read yours closely.

    Breach notice decoder
  2. 2.Freeze your credit if your SSN was listed

    A freeze with the three US bureaus is free and blocks new-credit fraud.

    SSN exposure action plan
  3. 3.Verify any “Manulife” or “John Hancock” call

    Hang up and call the number on your statement. Never move money on the strength of an inbound call.

    Identity protection lab
  4. 4.Watch for news on the Qilin claim

    If Manulife confirms the April 2026 claim, expect letters. Until then, be wary of emails that cite it.

CISO takeaways

Score your print and mail vendors

Mailing houses hold the whole client list with account numbers. Score them like any other critical vendor.

Vendor Risk Scorecard
Rehearse a vendor breach that names you in court

Customers sue the brand they know, not the vendor. Practise the response.

Vendor Breach Lab
Have a third-party breach checklist

Contracts, notices and letters when the breach is someone else’s.

Third-party breach checklist

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Signator Investors, notice of data breach (template) — California Attorney General, 2017
  2. 2.Advisor Group acquires Signator Investors — InvestmentNews, 21 Jun 2018
  3. 3.Insider says Manulife Bank didn’t protect customers’ highly private information for years — CBC News, 3 Apr 2023
  4. 4.DG3 North America, notice of data breach (template) — California Attorney General, 3 Jul 2024
  5. 5.John Hancock sued over data breach of vendor DG3 North America — Bloomberg Law, 1 Jul 2024
  6. 6.$600K DG3 settlement ends data breach lawsuit — ClassAction.org, 15 Jul 2025
  7. 7.John Hancock faces class suit over breach affecting six million — Bloomberg Law, 19 Sep 2024
  8. 8.Manulife Wealth listing (Qilin) — ransomware.live, 23 Apr 2026
  9. 9.NPC resolution, Manufacturers Life Insurance Co. (Phils.) (via search, not opened) — Philippine National Privacy Commission, 29 Jun 2023

Frequently asked questions

Was John Hancock hacked?

Not its core systems, as far as we found. Its then broker-dealer Signator had an intrusion in 2017, and two vendors (Infosys McCamish in 2023 and DG3 in 2024) were hacked, leading to lawsuits that named John Hancock entities.

Was Manulife hacked in 2026?

The Qilin ransomware group listed “Manulife Wealth” on its leak site on 23 April 2026. Manulife has not confirmed it in anything we found, so it is an unverified claim.

Is there a John Hancock data breach settlement?

The DG3 vendor case, which named John Hancock Investment Management, settled for $600,000, per ClassAction.org; claims closed 25 September 2025. We found no settlement figure for the Infosys McCamish suit against John Hancock Life.

What was the Manulife Bank “Databarn” story?

In April 2023 an insider told CBC that a Manulife Bank of Canada database held sensitive customer data with weak protections. Manulife denied any breach of safeguards and said there was no evidence of misuse.

What data was exposed in the John Hancock DG3 breach?

DG3’s notice lists name, address, email and account number; the settlement says about 25,852 of the roughly 53,227 people notified also had Social Security numbers exposed.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Manulife / John Hancock. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.