The Canadian Investment Regulatory Organization (CIRO) has advised that a cybersecurity incident was identified on August 11, 2025, and after an investigation, approximately 750,000 Canadians were affected.
On February 13, 2026, Slater Vecchio LLP filed a proposed class action lawsuit against Canadian Investment Regulatory Organization (CIRO) alleging that a significant data breach exposed highly sensitive personal and financial information of registrants and investors.
The lawsuit alleges that the breach resulted in sensitive information being accessed and stolen. The sensitive information includes:
A class action is a legal case through which one person makes a claim to the Court on behalf of a similarly situated class of people who have the same or a similar legal claim. A class action seeks to hold a defendant or defendants responsible for their conduct that affects each member of the class by resolving issues that are common to the class in the same legal proceeding, instead of each class member bringing a claim individually.
The individual who first files the claim must ask the Court for permission to proceed as a class action. If permission is granted (referred as “authorized” in Quebec, and “certified” in all other Canadian provinces) and the case may proceed as a class action, the Court will appoint an individual as “Representative Plaintiff” to represent the best interests of the class during the litigation and will define the class group. Each person who meets the criteria of the class group is considered a “Class Member”.
The proposed class seeks to represent all Canadians, excluding Quebec residents, whose information was accessed in the breach, with a subclass for Canadians who suffered direct harm – such as financial losses, identity theft, or fraud – tied to the misuse of their compromised data.
