WARNING: Massive data breach of Canadian Brokerage Accounts

stinkynuts · Jan 15, 2026

There was a massive data breach of Canadian brokerage accounts (not all).

The data that was leaked is very sensitive and includes:

Your full name
Address
Date of Birth
Government ID number and information
Annual Income
SIN Number
Brokerage Account Numbers
Account balances

Just a heads up. If you notice anything strange, be sure to take extra precautions. The data that has been leaked is so sensitive that a sophisticated scammer can wipe your account clean.

CIRO says about 750K people’s data affected by cybersecurity incident

The Canadian Investment Regulatory Organization says about 750,000 Canadian investors may have had personal information compromised in a data breach last year.

www.ctvnews.ca

stinkynuts · Jan 15, 2026

Since they have your phone number, if they manage to convince your cell phone carrier to swap SIMs, it's all over. They then have full access to your brokerage account and can wipe it clean. Be extremely vigilant of any signs that your SIM card has been swapped (SOS Mode with no service), or a message saying that your cell phone number is being ported to a new phone.

Never respond to text messages regarding financial information. If you receive a text saying your account has been compromised, NEVER respond, or call the number in the text. Immediately go the bank in person or call the toll free number on the back of your card.

stinkynuts · Jan 15, 2026

God of War · Jan 17, 2026

stinkynuts said:
There was a massive data breach of Canadian brokerage accounts (not all).

The data that was leaked is very sensitive and includes:

Your full name
Address
Date of Birth
Government ID number and information
Annual Income
SIN Number
Brokerage Account Numbers
Account balances

Just a heads up. If you notice anything strange, be sure to take extra precautions. The data that has been leaked is so sensitive that a sophisticated scammer can wipe your account clean.

CIRO says about 750K people’s data affected by cybersecurity incident

The Canadian Investment Regulatory Organization says about 750,000 Canadian investors may have had personal information compromised in a data breach last year.

www.ctvnews.ca

stinkynuts said:
Since they have your phone number, if they manage to convince your cell phone carrier to swap SIMs, it's all over. They then have full access to your brokerage account and can wipe it clean. Be extremely vigilant of any signs that your SIM card has been swapped (SOS Mode with no service), or a message saying that your cell phone number is being ported to a new phone.

Never respond to text messages regarding financial information. If you receive a text saying your account has been compromised, NEVER respond, or call the number in the text. Immediately go the bank in person or call the toll free number on the back of your card.

stinkynuts said:

Thanks for the heads up.

That is why I don't trust financial planners or one bank to absorb all my money. Especially when they only guarantee your deposit up to $100,000 per account through CDIC.

rajput · Jan 17, 2026

How would they get securities out of your brokerage account? It’s not that easy to transfer stocks out. Plus there’s all that multi factor authentication.

Caspertheghost · Jan 20, 2026

If you have your trading account at same bank as your savings and chequing accounts, and they are linked, they can sell your securities and then go to your other accounts and perform cash transfers, etc. There is another layer of security there, but it is the last barrier….

stinkynuts · Jan 20, 2026

Caspertheghost said:
If you have your trading account at same bank as your savings and chequing accounts, and they are linked, they can sell your securities and then go to your other accounts and perform cash transfers, etc. There is another layer of security there, but it is the last barrier….

Exactly.

Usually the two are linked. Meaning electronic transfers online are very simple to make to gain access to your online account. All they need is your account number and your telephone number to send the security code to.

angrymime666 · Jan 20, 2026

Caspertheghost said:
If you have your trading account at same bank as your savings and chequing accounts, and they are linked, they can sell your securities and then go to your other accounts and perform cash transfers, etc. There is another layer of security there, but it is the last barrier….

Some platforms have a secondary password to buy sell any securities which is different than your login password. Just another level of security

Scroty McDickface · Jan 20, 2026

Caspertheghost said:
If you have your trading account at same bank as your savings and chequing accounts, and they are linked, they can sell your securities and then go to your other accounts and perform cash transfers, etc. There is another layer of security there, but it is the last barrier….

So they sell like 30 of your positions, wait for the settlement date, then wait to transfer the cash out, all which must be done during business hours. Also a large transfer of money has to be approved by a human at the brokerage. This is like 3 business days to wipe out your account and you can see any trading activity or transactions. Interac e-Transfer limits vary by bank but generally cap single transfers around $3,000, with daily rolling limits around $3,000–$10,000, weekly limits around $10,000, and monthly limits between $20,000–$30,000.

stinkynuts · Jan 20, 2026

angrymime666 said:
Some platforms have a secondary password to buy sell any securities which is different than your login password. Just another level of security

This is actually the strongest layer of security, since only you know it. There’s no way to bypass it.

Obviously, it will be pointless to have the security feature. If the system didn’t lock you out after a few attempts. If they didn’t, they could just try to combination since the combination is only four digits.

Anyone with a brokerage account should activate this feature. I know TD has it.

angrymime666 · Jan 20, 2026

stinkynuts said:
This is actually the strongest layer of security, since only you know it. There’s no way to bypass it.

Obviously, it will be pointless to have the security feature. If the system didn’t lock you out after a few attempts. If they didn’t, they could just try to combination since the combination is only four digits.

Anyone with a brokerage account should activate this feature. I know TD has it.

I think scotia itrades as well

gf1288 · Jan 22, 2026

Thanks for sharing, scary stuff.

Goodoer · Jan 23, 2026

stinkynuts said:
This is actually the strongest layer of security, since only you know it. There’s no way to bypass it.

Obviously, it will be pointless to have the security feature. If the system didn’t lock you out after a few attempts. If they didn’t, they could just try to combination since the combination is only four digits.

Anyone with a brokerage account should activate this feature. I know TD has it.

I’ll check out my TD now. Thanks!

farquhar · Jan 23, 2026

My Mother got a letter from CIRO last night indicating that she is included in this data breach.

CIRO has offered 2 Years of Free Credit Monitoring with TransUnion and Equifax.

There is also a Class Action Lawsuit pending.

stinkynuts · Jan 23, 2026

farquhar said:
My Mother got a letter from CIRO last night indicating that she is included in this data breach.

CIRO has offered 2 Years of Free Credit Monitoring with TransUnion and Equifax.

There is also a Class Action Lawsuit pending.

If your mother is elderly, there’s a very good chance she could fall to a scam. Make sure she makes no major transactions without your knowledge.

Scammers will convince elderly people not to tell anybody. There is a high risk that your mother could lose everything in her account if she doesn’t take precautions.

farquhar · Jan 23, 2026

stinkynuts said:
If your mother is elderly, there’s a very good chance she could fall to a scam. Make sure she makes no major transactions without your knowledge.

Scammers will convince elderly people not to tell anybody. There is a high risk that your mother could lose everything in her account if she doesn’t take precautions.

Well, her account is with CIBC Wood Gundy; while there is an Online Portal, only the Investment Advisor is able to sell securities and withdraw funds to the linked Bank Account. There is no functionality to do that Online.

That doesn't mean that someone couldn't attempt to impersonate her; but the Advisor knows what her usual transaction activities are, and I am her Power of Attorney/Trading Authority as well.

If there were an unusual request from someone pretending to be my Mother by phone or e-mail, he would phone me immediately to verify.

I also have access to her Bank Account, so I can monitor that. And she doesn't know how to use a computer or cellphone, so perhaps that helps her avoid scams as well.

Unfortunately, I don't have the option to freeze her Credit File like consumers in Quebec and British Columbia do.

Now that her info is out there, it's out there forever; CIRO deserves to get sued, and I hope they settle quickly and don't drag the process out.

Muchadoaboutnothing · Feb 4, 2026

stinkynuts said:
If your mother is elderly, there’s a very good chance she could fall to a scam. Make sure she makes no major transactions without your knowledge.

Scammers will convince elderly people not to tell anybody. There is a high risk that your mother could lose everything in her account if she doesn’t take precautions.

This happened to my grandmother on more than one occasion. Crazy because shes always been super cheap but somehow was okay giving $10,000 three times to scammers. Same with my uncles dad. It was just awful

Search

WARNING: Massive data breach of Canadian Brokerage Accounts

stinkynuts

Super

CIRO says about 750K people’s data affected by cybersecurity incident

stinkynuts

Super

stinkynuts

Super

God of War

Member

CIRO says about 750K people’s data affected by cybersecurity incident

rajput

Active member

Caspertheghost

Well-known member

stinkynuts

Super

angrymime666

Well-known member

Scroty McDickface

New member

stinkynuts

Super

angrymime666

Well-known member

gf1288

Member

Goodoer

Doing Good. Looking for cohorts.

farquhar

Well-known member

stinkynuts

Super

farquhar

Well-known member

Muchadoaboutnothing

There was a star danced, and under that was I born