CIRO data breach: what happened and what to do

Canada's investment regulator, CIRO, detected a cyber incident on August 11, 2025. In January 2026 it confirmed about 750,000 investors were affected. Social insurance numbers, birth dates and account details were among the data.

View all 13,177 breaches

Breach date: 11 Aug 2025
Affected: 750,000
Data exposed: Dates of birth, Phone numbers, Income levels, Social insurance numbers, Government issued IDs, Investment account numbers, Account statements
Last updated: 25 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

CIRO, the Canadian Investment Regulatory Organization, oversees investment dealers and the trading marketplaces in Canada. It detected a cybersecurity incident on August 11, 2025 and disclosed it a week later. After a long forensic review, CIRO confirmed on January 14, 2026 that about 750,000 Canadian investors were affected, according to Investment Executive. Only some clients or former clients of CIRO's dealer members were involved, and CIRO began sending notification letters on January 14, 2026, per its update.

Sources checked: ciro.ca, investmentexecutive.com, bleepingcomputer.com

Last verified against the official page: 25 Oct 2026

How we research this Report an error

What was exposed

Reporting on CIRO's findings lists dates of birth, phone numbers, annual income, social insurance numbers, government-issued ID numbers, investment account numbers and account statements. CIRO says it does not store login credentials or security questions, so those were not affected.

The company's response

CIRO says it contained the incident, notified law enforcement and privacy commissioners, and has seen no evidence the information has been misused. It is offering two years of credit monitoring and identity theft protection through TransUnion and Equifax. CIRO also says it will never contact you by text or social media, ask for access to your investment or bank accounts, or ask you for payment. A proposed class action has been filed in Quebec.

What to do if you were in it

1

Read your CIRO letter and enroll in the free monitoring

If you got a notification letter, use it to sign up for the two years of credit monitoring CIRO offers.
2

Check your credit reports

The Canadian Anti-Fraud Centre advises checking your credit report at least once a year for accounts you didn't open, by contacting Equifax Canada and TransUnion Canada.
3

Guard your social insurance number

Don't give your SIN to anyone who contacts you by call, email, text or link. Share it only when you start the contact and know why it's needed.
4

Verify anything that claims to be CIRO

CIRO says it won't contact you by text or social media, or ask for account access or payment. Treat any message that does as a scam.
5

Use unique passwords and multi-factor login

Do this on your brokerage and bank accounts, as the Canadian Anti-Fraud Centre advises. Report fraud to the Centre at 1-888-495-8501.
6

Check other breaches

Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you when your details appear.

Frequently asked

Was I affected?

CIRO sent letters to affected investors starting January 14, 2026. CIRO's cyber incident page has a contact form if you want to ask in writing.

What was exposed?

Dates of birth, phone numbers, annual income, social insurance numbers, government ID numbers, investment account numbers and statements, per reporting on CIRO's findings.

Were my login details taken?

CIRO says it does not store login credentials or security questions, so they were not affected.

Is there a settlement?

A proposed class action has been filed in Quebec Superior Court over the incident.