InfoSecBulletin Cybersecurity for mankind
Around 750,000 Canadian investors were impacted in a sophisticated phishing attack revealed in August 2025. The self-regulatory organization revealed the details of the breach on January 14, 2026, following a thorough investigation that took over 9,000 hours.
Unauthorized access was due to a phishing campaign that compromised sensitive investor data held by CIRO for its regulatory duties.
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
The affected information includes birth dates, phone numbers, income, social insurance numbers, ID numbers, investment account numbers, and account statements.
CIRO stated that the organization did not gather login credentials, including passwords, security questions, or PINs, ensuring its security during the incident.
The breach impacted certain clients and former clients of CIRO dealer members. CIRO President and CEO Andrew Kriegler apologized and affirmed the organization’s commitment to helping those affected.
Response and Mitigation Measures:
CIRO quickly dealt with the incident and secured its systems. Initial findings indicated that registration data for member firms and individuals was breached, leading to immediate alerts for those affected.
CIRO is offering affected investors two years of free credit monitoring and identity theft protection from major credit agencies. Affected investors started getting letters from CIRO on January 14, 2026, containing instructions to activate protection services.
