The Canadian Investment Regulatory Organization said on January 14, 2026, that about 750,000 Canadian investors were affected by a sophisticated phishing attack first disclosed in August 2025, which may have exposed social insurance numbers, investment account numbers, phone numbers and other personal information, with notification letters starting that day.
What CIRO confirmed on January 14
CIRO, the self-regulatory organization that oversees investment dealers, mutual fund dealers and debt and equity trading in Canada, is based in Toronto. In an update dated January 14, 2026, it confirmed that as a result of a sophisticated phishing attack, first disclosed in August 2025, approximately 750,000 Canadian investors have been impacted.
The Canadian Press reported the same day that certain information, including social insurance numbers, investment account numbers and phone numbers, may have been impacted. CIRO’s own list is broader. It says the information that may have been affected includes dates of birth, phone numbers, annual income, social insurance numbers, government-issued identification numbers, investment account numbers and account statements.
That combination is sensitive because it links identity documents to financial details. A name and phone number alone can support nuisance calls. A date of birth, a social insurance number, a government ID number and an account statement together give a fraudster much of what is needed to impersonate someone convincingly.
CIRO said it is reaching out to affected investors to alert them to the incident, and The Canadian Press reported that those affected would be sent a notification letter starting on January 14. CIRO also said it is offering credit monitoring as an added precaution.
What was not taken, and why that distinction matters
CIRO was explicit about one limit to the breach. It does not collect account login details such as passwords, security questions and personal identification numbers, and therefore that information was not at risk, the organization said.
That distinction limits one kind of harm: the stolen data, on its own, does not hand someone the password to an investor’s account. It does not remove the other kinds. Social insurance numbers and dates of birth do not expire and cannot simply be reset the way a password can. That permanence is why credit monitoring and vigilance against targeted phishing matter after an incident of this kind, even where no misuse has yet been found.
CIRO said at the time of the January update that there was no evidence the information had been misused, but that it would continue to monitor for potential malicious activity, according to The Canadian Press. The organization had earlier said the attack was quickly contained.
How a regulator came to hold this information
CIRO explained that it received the information in the normal course of carrying out its regulatory mandate to protect investors from improper investment conduct and practices, and through its investigative, compliance assessment and market regulation work. In other words, the data was not collected because investors opened accounts directly with CIRO. It accumulated through the regulator’s supervision of firms and registered individuals across the industry.
That helps explain the scale. A breach at a single dealer would affect that dealer’s clients. A breach at the national regulator can reach records connected to many firms at once, which is how the confirmed total reached about 750,000 people.
“We are intent on doing right by those who are personally affected,” said Andrew Kriegler, CIRO’s president and chief executive officer. “We take our public interest role very seriously. Matters of privacy and security are extremely important to us, as are our guiding organizational values of transparency and accountability.”
Kriegler said CIRO remains committed to further strengthening its own cybersecurity defences and data security practices, and to supporting the broader investment industry’s efforts. CIRO also apologized for the incident in its update, saying it deeply regretted that it occurred.
What affected investors should watch for
For investors who receive a letter, the practical steps follow from the type of data involved. They should take up the credit monitoring offered, watch account statements for transactions they do not recognize, and treat unexpected calls, emails or messages that quote personal or account details with particular caution. A phishing attack caused this breach, and stolen personal details are commonly reused to make later phishing attempts look legitimate.
Investors who are unsure whether a communication is genuine should contact their dealer directly through a number or address they already trust, rather than using contact details supplied in a suspicious message. CIRO’s January 14 update remains the authoritative source for who is affected, and notification was to proceed by letter to those identified in its review.
