750,000 Impacted by Data Breach at Canadian Investment Watchdog

The Canadian Investment Regulatory Organization (CIRO) disclosed that hackers compromised the personal information of 750,000 individuals in an August 2025 cyberattack, with the incident traced to a sophisticated phishing campaign that also caused some systems to shut down. The organisation said the breach affected some member firms’ and their registered employees’ data, but did not impact CIRO’s critical functions.

CIRO disclosed the incident on 18 August, and its preliminary investigation found that some personal information, including annual income, dates of birth, government-issued ID numbers, phone numbers, investment account numbers, social insurance numbers, and account statements, was affected. Passwords, PINs, or security questions were not involved, as CIRO does not store such information.

The organisation has not found evidence of misuse or threat activity on the dark web, and is offering two years of free credit monitoring and identity theft protection to impacted individuals while it continues to monitor for malicious activity and provide notifications and a dedicated FAQ page.