Cyber Breach Affected 750,000 Canadian Investors, Regulator Says

Personal information of about 750,000 Canadian investors has been impacted by a “sophisticated phishing attack,” according to the Canadian Investment Regulatory Organization, in an update on the fallout from a major breach disclosed in August.

Information that might have been exposed includes dates of birth, phone numbers, income, social insurance numbers, government ID numbers, investment account numbers and account statements, CIRO said in a statement Wednesday, after thousands of hours of investigation into the incident with external experts.

CIRO started notifying affected investors on Wednesday and will offer them two years of credit monitoring and identity theft protection with major credit agencies. The watchdog said there’s no evidence yet that the information has been misused, but it is continuing to monitor threat activity and dark web exposure.

CIRO announced in August that a preliminary investigation had revealed that registration information for member firms and registered individuals had been affected. The watchdog’s update on Wednesday provided further details on the full extent of the incident.