Loading story…
Canada’s Canadian Investment Regulatory Organization (CIRO) confirmed a data breach affecting approximately 750,000 investors, attributing the incident to a sophisticated phishing attack detected in August 2025. CIRO said it conducted an extensive forensic investigation (citing 9,000+ hours of review by a third-party forensic firm) and determined that a limited subset of investigative, compliance, and market-surveillance data—including investor information—was copied from its systems; CIRO also reported that some systems were taken offline during response efforts but that critical operations were not disrupted.
CIRO warned that exposed data may include dates of birth, phone numbers, annual income, Social Insurance Numbers, government-issued ID numbers, investment account numbers, and account statements, while stating that login credentials were not at risk. The organization said it has no evidence of misuse and has not observed related dark-web exposure to date, and it reported notifying law enforcement and relevant authorities (including privacy commissioners) while offering affected individuals two years of credit monitoring and identity theft protection.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Starting January 14, 2026, CIRO began notifying confirmed affected individuals and offered two years of free credit monitoring and identity theft protection. CIRO also said it had notified law enforcement and privacy commissioners and reported no evidence of misuse or dark web exposure at that time.
On January 14, 2026, CIRO concluded an investigation spanning more than 9,000 hours and determined that approximately 750,000 investors were impacted. The review found that stolen data may include personal and financial information such as Social Insurance Numbers, government-issued ID numbers, and investment account details, while login credentials, PINs, and security questions were not affected.
On August 18, 2025, CIRO publicly announced the breach after detecting the threat the previous week. The organization said the incident affected some systems but did not disrupt critical operations.
On August 11, 2025, the Canadian Investment Regulatory Organization detected a cybersecurity threat later attributed to a sophisticated phishing attack. CIRO shut down certain non-critical systems, contained the incident, and began an investigation with third-party forensic support.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcerescana.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Betterment** disclosed that a **social engineering** attack against a **third-party platform account** used for customer communications enabled unauthorized access to internal systems in early January, leading to the exposure of personal data tied to **1,435,174 accounts**. The intruder used the access to send **fraudulent crypto-themed promotional messages** impersonating Betterment and promising to “triple” cryptocurrency sent to attacker-controlled wallets (including **Bitcoin and Ethereum** addresses). Betterment said it revoked the unauthorized access the same day it was detected, warned customers to ignore the messages, and initiated a forensic investigation with external incident-response support. Breach analysis and indexing by **Have I Been Pwned** indicated the exposed dataset included **email addresses, names, and location data**, with reporting also citing additional PII such as **dates of birth, physical addresses, phone numbers, device information, and employment-related details**. Betterment stated there is **no evidence** that customer investment accounts were accessed or that **passwords/authentication tokens** were compromised, characterizing the incident as an exposure of contact/identity data rather than account credentials. Separate reporting noted Betterment also experienced **intermittent outages attributed to a DDoS attack and extortion attempts** around the same period, but this was described as distinct from the social-engineering-driven data exposure.
Jun 29, 2026
**Canadian Tire Corporation** disclosed a major breach of its **e-commerce customer database** after identifying unauthorized access on **October 2, 2025**, exposing personal data tied to **38+ million customer accounts**. Exposed data included names, physical addresses, email addresses, year of birth (and for **<150,000** accounts, full dates of birth), and **encrypted passwords**; some records also contained **truncated payment card numbers**. The company stated the exposed financial data could not be used to conduct transactions, and reported **no impact** to in-store systems, *Canadian Tire Bank*, or *Triangle Rewards*. Canadian Tire reported it **remediated the underlying issue**, notified regulators, and planned customer notifications and **credit monitoring**. *Have I Been Pwned* added the incident to its corpus, reporting roughly **42 million records** (including **~38.3 million email addresses**) and indicating the dataset includes **PBKDF2 password hashes** along with additional fields such as phone numbers and gender, increasing the likelihood of credential-stuffing and identity-fraud follow-on activity.
Jun 29, 2026
**Cloud Imperium Games (CIG)** disclosed that it suffered an IT incident on **January 21** described as a “systematic and sophisticated attack,” resulting in **unauthorized access to some backup systems** and **limited access to users’ personal data**. CIG stated the exposed information was limited to basic account details such as **names, usernames, contact information, and dates of birth**, and asserted that **no passwords** were impacted, **no financial/payment data** was accessible, access was **read-only**, and there was **no data modification**. The disclosure triggered backlash from users over **how and when** the company communicated the breach, with reporting highlighting that CIG initially surfaced the incident via a low-visibility website “service alert” popup rather than prominent notices or direct outreach. Coverage also emphasized that even “basic” identity and contact data can materially increase **phishing and social-engineering risk**, especially when combined with other breached datasets to build richer victim profiles.
Jun 29, 2026