NOTICE OF DATA PRIVACY EVENT

Hub International Limited (“HUB”) is the parent of several insurance brokerage firms. HUB and its affiliates provide an array of property, casualty, risk management, life and health, employee benefits, investment, and wealth management products and services.

HUB maintains information regarding individuals, provided by those individuals, in several categories, to provide insurance services or investment consulting services. HUB also receives and maintains information about individuals from other entities including insurance carriers and employers as part of the services it provides these entities.

Once suspicious activity was detected, HUB took proactive measures to limit access to its systems while preserving its ability to serve customers. Those actions, along with HUB’s existing tools and procedures, helped to limit the unauthorized access. We also worked to review our network to determine whether other data was accessed or impacted, and to confirm the unauthorized access was terminated.

As a result of that review, HUB identified that certain files were copied from certain systems in its computer network without authorization. Because of this, HUB is undertaking a comprehensive review of those files for sensitive information so that it can notify individuals.

The investigation and notification process are ongoing, and HUB is providing relevant notices as information becomes available.

The investigation confirmed that certain systems within HUB’s network were accessed without authorization and data was copied between December 2022 and January 2023. The unauthorized third party is no longer in HUB’s network.

This is a single event.

HUB has robust security practices and has added additional security personnel and tools in response to this event. While no set of tools and procedures is perfect, HUB is constantly evaluating its security posture and looking for opportunities to improve.

Comprehensive computer forensic investigations for a company of this size and scale can take time. After HUB identified the potentially impacted data, it reviewed the data to determine if it contained sensitive information. As a result, HUB just recently confirmed the types of data impacted and specifically to whom it related.

HUB worked to obtain contact information for individuals so that it could mail written notice,. The review and notification process are ongoing, and HUB is providing relevant notices as information becomes available. HUB appreciates your understanding and patience.

No, malware encrypted files were not identified during the investigation.

If you received a written letter from HUB, then your information was identified in the data reviewed.

The categories of information that may be affected vary by individual. Please refer to the “What Information Was Involved” section of the notice letter to identify the categories of information related to you that were identified in the reviewed files.

To date, there is no evidence of data misuse. However, as a matter of good practice, we encourage individuals to take steps to protect their personal information, including enrolling in the monitoring product being offered to affected individuals that have received a letter.

Because of privacy concerns, HUB cannot provide you with information about other individuals who may have been impacted by this event.

HUB notified law enforcement shortly after learning of the event.

Yes, HUB is offering monitoring services to affected individuals through Equifax in relation to this event. Affected individuals will receive a letter.

If you are having trouble using the code provided in your letter to enroll in credit monitoring through Equifax, please try the following steps:

• Please ensure the code is being entered EXACTLY as it appears in the letter you received, and that you are entering the code in the following website: www.equifax.com/activate
• Please ensure your internet browser is updated to the latest version.
• If you are still having trouble enrolling, please try using an alternate internet browser (such as Microsoft Edge or Google Chrome).

The party responsible for the event was not able to be identified.

If you observe fraudulent charges on your credit or debit card / financial account, we encourage you to immediately contact the issuing financial institution for instructions on how to dispute charges and have a new account issued.

If you believe you are the victim of identity theft or fraud or have reason to believe your personal information has been misused, you should immediately:

1. File a complaint with the police. Ask for the case reference number and the officer's name and telephone number. If you choose to obtain a copy of the police report, make sure it states your name and SIN.

2. Contact the Canadian Anti-Fraud Centre at 1-888-495-8501. The national anti-fraud call centre is jointly managed by the Royal Canadian Mounted Police, Ontario Provincial Police and Competition Bureau Canada. They provide advice and assistance about identity theft.

3. Contact Canada’s two national credit reporting agencies. Ask for a copy of your credit report. Review it for any suspicious activity. Also check to see if your credit file should be flagged (fees may be applicable). To obtain additional information regarding fees and other requirements, please contact the credit reporting agencies, as described above.

4. Inform your bank and creditors by phone and in writing about any irregularities.

5. Report any irregularities in your mail delivery to Canada Post, such as opened envelopes or missing financial statements or documents.

6. Visit a Service Canada office. If you suspect that your social insurance number is being used fraudulently, visit a Service Canada office and bring all the necessary documents with you proving fraud or misuse of your SIN. Also bring an original identity document (your birth certificate or immigration or citizenship document). A Service Canada official will review your information and provide you with assistance and guidance.

HUB encourages you to contact the relevant financial institution and report the matter.

If you believe you are the victim of identity theft or fraud or have reason to believe your personal information has been misused, you should immediately:

1. File a complaint with the police. Ask for the case reference number and the officer's name and telephone number. If you choose to obtain a copy of the police report, make sure it states your name and SIN.

2. Contact the Canadian Anti-Fraud Centre at 1-888-495-8501. The national anti-fraud call centre is jointly managed by the Royal Canadian Mounted Police, Ontario Provincial Police and Competition Bureau Canada. They provide advice and assistance about identity theft.

3. Contact Canada’s two national credit reporting agencies. Ask for a copy of your credit report. Review it for any suspicious activity. Also check to see if your credit file should be flagged (fees may be applicable). To obtain additional information regarding fees and other requirements, please contact the credit reporting agencies, as described above.

4. Inform your bank and creditors by phone and in writing about any irregularities.

5. Report any irregularities in your mail delivery to Canada Post, such as opened envelopes or missing financial statements or documents.

6. Visit a Service Canada office. If you suspect that your social insurance number is being used fraudulently, visit a Service Canada office and bring all the necessary documents with you proving fraud or misuse of your SIN. Also bring an original identity document (your birth certificate or immigration or citizenship document). A Service Canada official will review your information and provide you with assistance and guidance.

HUB must comply with federal, provincial, local government, and contract records retention guidelines. To further evaluate your request, please fill out the form at this link.

No, if you received a letter, that does not necessarily mean that you are the victim of identity theft or fraud. However, as a matter of good practice, HUB encourages individuals to take the steps explained in their notice letters to protect their personal information, including enrolling in the monitoring product being offered.

As detailed in the applicable notice letter, you should:

• Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, we recommend that you remain vigilant, as always, to the possibility of fraud and identity theft by reviewing your financial statements and accounts regularly for any unauthorized activity.

• Obtain a Copy of Your Credit Report: To obtain a free copy of your credit report, you can contact the two Canadian credit reporting agencies directly. If you choose to access your credit report online, you may have to pay a fee. Contact information for the two Canadian credit reporting agencies is as follows:

Equifax Canada Co. National Consumer Relations P.O. Box 190 Montreal, QC H1S 2Z2 www.equifax.ca (800) 465-7166

TransUnion Attention: Consumer Relations Centre 3115 Harvester Road, Suite 201 Burlington ON L7N 3N8 www.transunion.ca (800) 663-9980

• If you believe you are the victim of identity theft or fraud or have reason to believe your personal information has been misused, you should immediately:
1. File a complaint with the police. Ask for the case reference number and the officer's name and telephone number. If you choose to obtain a copy of the police report, make sure it states your name and SIN.
2. Contact the Canadian Anti-Fraud Centre at 1-888-495-8501. The national anti-fraud call centre is jointly managed by the Royal Canadian Mounted Police, Ontario Provincial Police and Competition Bureau Canada. They provide advice and assistance about identity theft.
3. Contact Canada’s two national credit reporting agencies. Ask for a copy of your credit report. Review it for any suspicious activity. Also check to see if your credit file should be flagged (fees may be applicable). To obtain additional information regarding fees and other requirements, please contact the credit reporting agencies, as described above.
4. Inform your bank and creditors by phone and in writing about any irregularities.
5. Report any irregularities in your mail delivery to Canada Post, such as opened envelopes or missing financial statements or documents.
6. Visit a Service Canada office. If you suspect that your social insurance number is being used fraudulently, visit a Service Canada office and bring all the necessary documents with you proving fraud or misuse of your SIN. Also bring an original identity document (your birth certificate or immigration or citizenship document). A Service Canada official will review your information and provide you with assistance and guidance.

• Fraud Alert: You may want to consider placing a fraud alert on your credit report. The process of placing a fraud alert is slightly different with each of the credit reporting agencies. The fraud alert lasts six years and there may be a cost. Be prepared to supply your SIN and other basic information.
• To place a fraud alert on your TransUnion credit report, you can visit the self-service website found here: https://secure-ocs.transunion.ca/secureocs/home.html. Or you can call TransUnion at 1-800-663-9980 and follow the automated prompts to place a fraud alert.
• To place a fraud alert on your Equifax credit report, you can call Equifax at 1-800-465-7166 and follow the voice prompts.

• Alert the CRA: You can place an alert with the Canada Revenue Agency by calling them at 1-800-959-8281.

This alert requires (in some provinces) or encourages lenders and creditors to call you before extending credit. The process of placing a fraud alert is slightly different with each of the credit reporting agencies. The fraud alert lasts six years and there may be a cost. Be prepared to supply your SIN and other basic information.

• To place a fraud alert on your TransUnion credit report, you can visit the self-service website found here: https://secure-ocs.transunion.ca/secureocs/home.html. Or you can call TransUnion at 1-800-663-9980 and follow the automated prompts to place a fraud alert.
• To place a fraud alert on your Equifax credit report, you can call Equifax at 1-800-465-7166 and follow the voice prompts.

You should monitor your credit report regardless of whether your information was accessible without authorization or you think you may be a victim of identity theft or fraud.

To obtain a free copy of your credit report, you can contact the two Canadian credit reporting agencies directly. If you choose to access your credit report online, you may have to pay a fee. Contact information for the two Canadian credit reporting agencies is as follows:

If you believe you are the victim of identity theft or fraud or have reason to believe your personal information has been misused, you should immediately:

1. File a complaint with the police. Ask for the case reference number and the officer’s name and telephone number. If you choose to obtain a copy of the police report, make sure it states your name and SIN.

2. Contact the Canadian Anti-Fraud Centre at 1-888-495-8501. The national anti-fraud call centre is jointly managed by the Royal Canadian Mounted Police, Ontario Provincial Police and Competition Bureau Canada. They provide advice and assistance about identity theft.

3. Contact Canada’s two national credit reporting agencies. Ask for a copy of your credit report. Review it for any suspicious activity. Also check to see if your credit file should be flagged (fees may be applicable). To obtain additional information regarding fees and other requirements, please contact the credit reporting agencies, as described above.

4. Inform your bank and creditors by phone and in writing about any irregularities.

5. Report any irregularities in your mail delivery to Canada Post, such as opened envelopes or missing financial statements or documents.

6. Visit a Service Canada office. If you suspect that your social insurance number is being used fraudulently, visit a Service Canada office and bring all the necessary documents with you proving fraud or misuse of your SIN. Also bring an original identity document (your birth certificate or immigration or citizenship document). A Service Canada official will review your information and provide you with assistance and guidance.

You should remain vigilant and review account statements regularly for suspicious activity. If you identify suspicious activity or fraud, you should immediately contact the impacted institution and law enforcement to report it.

You may request a copy of your loved one’s credit report. To obtain a free copy of the credit report, you can contact the two Canadian credit reporting agencies directly. If you choose to access the credit report online, you may have to pay a fee. Contact information for the two Canadian credit reporting agencies is as follows:

You may also send a request in writing to the credit reporting agencies to place a “Deceased. Do not issue credit” flag on a credit file. You can find the contact information for the two main credit bureaus, Equifax and TransUnion, online.

Equifax can be located at www.equifax.ca

TransUnion can be located at www.transunion.ca

You can call 1-833-627-2764 for more information, if you have more questions, or for information on the complimentary services that are being provided.