What happened
The Canadian Investment Regulatory Organization confirmed that a sophisticated phishing attack, first disclosed in August 2025, affected about 750,000 Canadian investors. Data that may have been accessed includes dates of birth, phone numbers, income, social insurance numbers, government ID numbers, account numbers and statements. CIRO said there is no evidence of misuse and is offering two years of credit monitoring. (Canadian Investment Regulatory Organization (CIRO), Jan. 14, 2026)
What it means for Canada
One phishing attack on a regulator exposed SINs, ID numbers and account statements for 750,000 investors whose dealers did nothing wrong.
- Sectors
- Investment and mutual fund dealers · Regulators · Investors
- Tools involved
- Email (phishing)
- Canadian rules
- PIPEDA: report breaches with a real risk of significant harm to the OPC, notify affected people, keep a record of every breach
Takeaways for Canadian businesses and individuals
- BusinessRun phishing exercises with personalized lures; leaked identity data makes them more convincing.
- BusinessWarn clients that criminals may quote real account details to sound legitimate.
- IndividualsIf you got a CIRO letter, activate the free two-year credit monitoring it offers.
- IndividualsAsk your credit bureaus about a fraud alert if your SIN was exposed.
For the Canadian AI sector
Leaked identity data feeds more convincing, personalized phishing, which AI makes cheap to produce at scale.
Written by AgentsNorth from the source below. General information, not legal or security advice.