Data breach at Canada’s Investment Watchdog Canadian Investment Regulatory Organization impacts 750,000 people

CIRO experienced a phishing-driven data breach in August 2025 that resulted in the copying of a limited subset of investigative, compliance and investor data — including personal and financial information for approximately 750,000 people. The organization contained the incident, retained third‑party forensic investigators, reported no evidence of passwords/PINs or dark‑web exposure, notified authorities, and is providing two years of credit monitoring to affected individuals.