Data breach at Canada’s Investment Watchdog Canadian Investment Regulatory Organization impacts 750,000 people

A data breach at Canada’s investment watchdog, the Canadian Investment Regulatory Organization (CIRO), affected about 750,000 people after threat actors stole personal data in an August 2025 phishing attack, according to CIRO. The incident forced some systems offline but did not disrupt critical operations, and CIRO said it contained the security incident with no ongoing threat.

Investigators found that a limited subset of investigative, compliance and market surveillance data, including some investor information, was copied, though no passwords or PINs were exposed and there was no evidence of data misuse or dark web exposure. CIRO stated that it would delete investor information when no longer required for its regulatory activities and continues to monitor for malicious activity.

Affected individuals are being offered two years of free credit monitoring and identity theft protection as part of the response. The organisation also noted that it notified law enforcement and privacy authorities across Canada and engaged a leading third-party forensic IT investigator to determine the scope of the data impacted. According to CIRO’s FAQ page, more than 9,000 hours of review were dedicated to the investigation.