The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →CIRO says a phishing attack affected approximately 750,000 Canadian investors, but the breach did not involve all Canadian investors. The affected people were some current or former clients of firms regulated by the Canadian Investment Regulatory Organization (CIRO). Potentially exposed information includes identity and investment details; CIRO says it does not collect account passwords, security questions or PINs.
What happened, and when?
CIRO identified a cybersecurity incident on August 11, 2025. On August 18, it publicly disclosed a cybersecurity threat, saying it had shut down some systems as a precaution while critical functions remained available. On January 14, 2026, CIRO said the incident resulted from a sophisticated phishing attack and confirmed the scale of the investor impact. The public statements do not identify a specific attacker. CIRO’s incident page, initial notice and January 14 release document the timeline.
CIRO says it contained the incident, notified law enforcement and relevant authorities, including privacy commissioners, and engaged a third-party forensic IT investigator. CIRO reported that the examination took more than 9,000 hours; the Canadian Securities Administrators described the investigation as more than 9,000 hours over five months. The CSA’s 2025 oversight report provides the latter description.
Who was affected?
CIRO confirmed that approximately 750,000 Canadian investors were affected. They were some current or former clients of CIRO-regulated dealer members—not all Canadian investors and not necessarily every client of any one firm. If you received a CIRO notification, it means CIRO identified some information about you as affected.
#1 Best Overall
What information may have been exposed?
CIRO says information that may have been copied from its systems includes:
- Date of birth and phone number
- Annual income
- Social Insurance Number and government-issued identification number
- Investment account number and account statements
These are possible categories across the affected population; CIRO does not say every affected person had every category exposed. Your notification letter specifies which categories apply to you. CIRO’s investor FAQ explains the notices.
CIRO says passwords, security questions and PINs were not at risk because it does not collect those account login details. That statement is limited to those credentials: the potentially exposed identity and investment information is still sensitive. CIRO’s initial notice said Canadians’ investments were not at risk; the later disclosure concerns personal information copied from CIRO systems, not a public finding that brokerage accounts were accessed.
How can you find out if you were affected?
CIRO began sending notification letters on January 14, 2026. It sent additional notices in March and April after working with member dealers to match fragmented or incomplete records with contact details. CIRO’s FAQ says those later notices were the final group. Check your letter for the specific categories associated with your information.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →If you did not receive a letter but want to ask whether you should have, use the contact instructions on CIRO’s incident page and investor FAQ. Follow the current instructions there rather than relying on contact details copied elsewhere, which may change.
What should affected investors do?
- Enroll in the offered protection. CIRO says affected investors are offered two years of credit monitoring and identity theft protection through Equifax and TransUnion. Use the enrollment instructions in your CIRO letter.
- Review investment accounts periodically. Look for activity you do not recognize and contact your investment firm through its usual, independently verified channels if something seems wrong.
- Be alert to impersonation attempts. CIRO says it will not contact people by text or social media, ask for access to investment or bank accounts, demand payment, or request information to facilitate access to those accounts. Treat messages claiming otherwise with suspicion and verify them through CIRO’s official incident page.
Credit-freeze availability differs by province and can change. Check current provincial and credit-bureau information before relying on a freeze as an option.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is the exposed information being misused?
In its latest available FAQ, CIRO said it had no indication that the information had been misused or made available on the dark web and that it continued to monitor. That is CIRO’s reported status at the time of the FAQ, not a guarantee that misuse cannot occur. Check the FAQ for current updates.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
