CIRO proposes $8.3 million settlement after 750,000-person data breach
Nov 10, 2026 · Summarized by Fundy Tech from Wealth Professional
CIRO has proposed an $8.3 million settlement over a 2025 breach affecting about 750,000 Canadians. The deal would add credit monitoring and reimburse documented losses up to $10,000.
Key points
- The breach began on or about August 6, 2025 and was first detected August 11.
- Affected data included SINs, ID numbers, phone numbers and account statements.
- The settlement still needs Superior Court of Québec approval.
The full story
Canada’s investment regulator, the Canadian Investment Regulatory Organization, has agreed to an $8.3 million national settlement to resolve a class action tied to a 2025 data breach. The proposed settlement was announced on November 10, 2026 and covers people in Canada whose data was held by CIRO, was compromised in the cyber incident that began on or about August 6, 2025, and who received written notice from CIRO confirming their information was affected.
CIRO says it denies all allegations and any liability. The breach was first detected on August 11, 2025, and publicly disclosed on August 18 after CIRO shut down non-critical systems and launched a forensic investigation. That investigation reportedly took about 9,000 hours and confirmed in January 2026 that exposed data included income information, dates of birth, government-issued identification numbers, phone numbers, Social Insurance Numbers, investment account numbers and account statements. Passwords and PINs were not compromised.
The breach was traced to a phishing attack. The affected group included retail investors and registered employees and executives of CIRO member firms whose information was held for regulatory and investigative purposes. If the Superior Court of Québec approves the settlement, class members would get two more years of credit monitoring, identity protection services and identity theft insurance through Equifax Canada or TransUnion, or both.
People with documented losses directly tied to the incident could claim up to $10,000. Those who do not submit documentation would share a separate pool for undocumented claims. All payments could be reduced proportionally if approved claims exceed available funds. A parallel action in British Columbia would be dismissed, stayed or discontinued if the settlement is approved.
Why it matters
This is important for Canadians whose financial and personal information was exposed. If approved, eligible people could get more monitoring and some reimbursement, but claims may be reduced if costs exceed available funds.
Who’s affected: About 750,000 Canadians affected by the CIRO breach
What’s next
The Superior Court of Québec still has to approve the settlement. The B.C. action would be resolved as part of that approval.
What to do
- Watch for CIRO claim instructions.
- Keep any breach-related receipts or records.
- Review credit reports and account statements.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.