Canadian Investment Regulatory Organization data breach affects 750,000 investors

As reported by Bleeping Computer, the Canadian Investment Regulatory Organization (CIRO) has confirmed that a data breach experienced last year will impact approximately 750,000 Canadian investors. The organization, which is Canada's national self-regulatory body for investment dealers and mutual fund dealers, discovered the cybersecurity threat on August 11 last year and has since completed an extensive forensic investigation.

The breach, which CIRO announced on August 18, resulted in the exfiltration of personal information from current and former members. The compromised data varies by individual but may include dates of birth, phone numbers, annual income, social insurance numbers, government-issued ID numbers, investment account numbers, and account statements. CIRO stated that login credentials and account security questions were not affected as this information is not stored on its systems. The investigation involved over 9,000 hours and found no evidence of the stolen data being misused or published on the dark web.

To mitigate potential risks, CIRO will offer affected investors a free two-year credit monitoring and identity theft protection service. The breach is considered one of the most significant cybersecurity events in Canada last year.

Source: Bleeping Computer