750K investors’ income exposed after phishing attack hit CIRO

The Canadian Investment Regulatory Organization (CIRO) revealed that a phishing attack compromised the organization and led to hundreds of thousands of investors losing their personal details, including income and account statements.

Canada’s core investment regulatory institution, CIRO, is the latest poster child for the devastating impact of phishing attacks. The organization, formed in 2023, revealed that a “sophisticated phishing attack” impacted 750,000 Canadian investors.

The attack, first spotted in August 2025, exposed a treasure trove of sensitive investors' data. According to a breach notice by CIRO, attackers may have accessed:

• Dates of birth
• Phone numbers
• Annual income
• Social insurance numbers
• Government-issued ID numbers
• Investment account numbers
• Account statements

Malicious actors could use the stolen data for various purposes, the most obvious being identity theft. Meanwhile, combining social insurance numbers with synthetic identities enables attackers to create fake accounts.

Moreover, there’s enough exposed data for attackers to set up intricate phishing attacks. In these cases, cybercrooks craft malicious emails that, because of the leaked data, include accurate victim details, fostering the illusion that the email is legitimate.

Since the data included annual income information and account statements, attackers would try to maximize their efforts by targeting the wealthiest individuals, where a single successful hit would be most profitable.

Additionally, attackers could try to combine government IDs with financial data for tax fraud, fraudulent credit applications, which could be a major headache for victims.

Meanwhile, CIRO noted that, as the organization does not collect account login details, this type of data could not be exposed to a cyberattack. It also said it will provide impacted investors with two-year complimentary credit monitoring services.

“We are intent on doing right by those who are personally affected,” said Andrew Kriegler, President and Chief Executive Officer of CIRO.

The organization did not specify what prompted it to dub the phishing attack as “sophisticated.” Typically, these types of attacks involve a malicious email or a document being sent to the target organization. Once somebody inside the organization opens it and proceeds to follow the attacker's instructions, malware can be deployed in numerous ways.

Unlock exclusive Cybernews content on YouTube.