Canadian investment platform Wealthsimple disclosed a data breach

Wealthsimple, the Canadian investment platform, disclosed a data breach that affected some customers and was traced to a supply chain attack via a trusted third‑party software package. The company said the security incident was detected on 30 August 2025 and was contained within hours, with all accounts remaining secure and no funds accessed or stolen.

It added that a specific software package written by an unnamed third party had been compromised, resulting in personal data belonging to less than 1% of its clients being accessed without authorisation for a brief period. Accessed information included contact details, government IDs provided during sign‑up, financial details such as account numbers, IP address, Social Insurance Number, and date of birth.

Wealthsimple notified affected clients by email and offered two years of free credit monitoring and other protections, while regulators were informed and security measures were enhanced. The firm, founded in 2014 in Toronto, emphasised that non‑notified clients were not impacted and that passwords were not compromised.