750,000 Impacted by Data Breach at Canadian Investment Watchdog

The Canadian Investment Regulatory Organization (CIRO) this week revealed that hackers compromised the personal information of 750,000 individuals in an August 2025 cyberattack.

The data breach, CIRO says, was the result of a sophisticated phishing attack, and resulted in some systems being shut down. The incident did not impact the organization’s critical functions.

“We are confident that the incident is contained and that there is no active threat in ClRO’s environment,” the organization says.

CIRO disclosed the incident on August 18, saying that its preliminary investigation determined that “some personal information of member firms and their registered employees was affected”.

Now, the investment watchdog says the compromised personal information includes annual income, dates of birth, government-issued ID numbers, phone numbers, investment account numbers, social insurance numbers, and account statements.

“CIRO received this information in the normal course of carrying out its regulatory mandate to protect investors from ...