That's an excellent question.
The company, MSH, is the one that is feared to have been breached. Whether Canada Life is ultimately accountable for the breach itself is a question I don't know the answer to. Ultimately, Canada Life is the one responsible and accountable for the administration of the benefits generally, whether it's subcontracted or not.
To directly answer your question, I'm not sure who ultimately will be accountable within their own contract.