The Canadian Investment Regulatory Organization (CIRO)—the body entrusted with overseeing Canada’s entire investment industry—suffered a catastrophic data breach that left approximately 750,000 Canadian investors’ most sensitive personal and financial information wide open to hackers. This was not a mere “cybersecurity incident,” as CIRO and the media soft-pedalled it. This was a massive, preventable disaster that exposed Social Insurance Numbers, dates of birth, government-issued ID numbers, annual incomes, investment account numbers, and full account statements. This information is highly sensitive and can be used for identity theft and financial fraud.

The sophisticated phishing attack was detected on August 11, 2025,  however CIRO waited a full five months—until January 14, 2026—before finally notifying the victims. That delay is not “due diligence.” It is outrageous negligence. While CIRO spent over 9,000 hours on a forensic investigation (after the fact), hundreds of thousands of Canadians were left completely unaware that their identities and financial lives were compromised. Some only received their notification letters months later still. This is a textbook case of putting bureaucracy and “cover-your-ass” above the safety of the people whose data they hold.

Even more damning is the media blackout. Canada’s mainstream press largely ignored this scandal. CTV ran one short, understated article. The Globe and Mail covered it but that was paywalled and hard to access and that was essentially it. Meanwhile, a UK-based cybersecurity outlet, The Record, provided more thorough reporting than our own national media. When a foreign outlet tells Canadians more about a massive domestic breach than our own “trusted” newsrooms, something is deeply wrong. Our media’s silence is complicity.

The greatest outrage however, is this: CIRO only hired leading third-party cybersecurity experts after the breach had already happened. They did not have proper experts in place protecting the most sensitive financial data of three-quarters of a million Canadians before it was stolen. They reacted. They did not prevent. They failed at the most basic duty of any organization holding SINs and investment records—and then had the gall to apologize for the “inconvenience.” This is not competence. This is reckless endangerment of the public.

Now affected Canadians are fighting back: multiple proposed class action lawsuits have been filed against CIRO in Quebec and British Columbia, alleging negligence and the harmful delay in notification.

Now ask yourself: if Canada’s investment regulator cannot protect 750,000 investors’ data—and only brings in experts after the barn door is blown open—how on earth can the same government and its agencies possibly secure a Central Bank Digital Currency (CBDC) or full digital banking system? They cannot. A CBDC would put every Canadian’s entire financial life under one centralized, hackable roof controlled by the very people who just proved they cannot keep data safe.

This massive CIRO breach is the flashing red warning light. Cash is still king. Physical cash and precious metals cannot be remotely stolen, frozen, or surveilled. Do not let them force you into their digital cage.

Action4Canada members: this is not abstract. This is real. Share the CIRO notification letter. Demand answers. Reject the digital dollar. Protect your money, your privacy, and your freedom while you still can.