Slater Vecchio LLP has filed a proposed class action against the Canadian Investment Regulatory Organization (CIRO), alleging that a significant data breach compromised the highly sensitive personal information of approximately 750,000 CIRO registrants and Canadian investors. The action seeks to represent all Canadians, other than residents of Quebec, whose information was accessed in the alleged data breach.
The lawsuit alleges that CIRO was the target of a sophisticated phishing attack in August 2025 that enabled an unauthorized third party to access and exfiltrate confidential information from its systems.
For registrants, the allegedly compromised data includes names, addresses, dates and places of birth, contact information, government-issued identification, banking details, civil and criminal disclosure records, investigation notes, and employment and licensing information.
For investors, the exposed information reportedly includes dates of birth, telephone numbers, annual income, Social Insurance Numbers, government-issued identification numbers, investment account numbers, and investment account statements.
The claim asserts that CIRO, as a national self-regulatory organization recognized under Canadian securities legislation, owed a duty to safeguard the personal information entrusted to it and to comply with applicable federal and provincial privacy laws.
“Canadians are required to provide highly sensitive financial and personal information to regulators like CIRO, with the expectation that it will be rigorously protected,” said Anthony Vecchio, K.C., partner at Slater Vecchio LLP. “When that trust is broken by a cyberattack, the consequences can be serious and long-lasting, including heightened risks of identity theft, fraud, and ongoing privacy harms. This action seeks to hold CIRO accountable and to reinforce that safeguarding personal information is a fundamental component of any regulator’s public-interest mandate.”
Individuals who believe they may have been affected by the CIRO data breach can submit their name and contact information, and indicate whether they received a breach notification from CIRO, through the firm’s website: slatervecchio.com/class-action/canadian-investment-regulatory-organization-ciro-data-breach-class-action/.