A proposed settlement covering 750,000 affected Canadians includes credit monitoring and reimbursement of up to $10,000 per claimant
Canada's investment regulator has agreed to an $8.3 million national settlement to resolve a class action arising from the data breach that compromised the personal and financial information of approximately 750,000 Canadians in August 2025, according to Montréal-based settlement administrator Concilia Services Inc.
The proposed settlement in Ovadia v. Canadian Investment Regulatory Organization was announced on November 10, 2026, and covers all persons in Canada whose data was held by the Canadian Investment Regulatory Organization (CIRO) and was compromised in the cyber incident that began on or about August 6, 2025, and who received written notification from CIRO confirming their information had been affected.
CIRO denies all allegations and any liability in connection with the breach. The settlement is intended to provide compensation to affected individuals, subject to court approval.
What happened in the August 2025 breach
The breach - one of the most significant cybersecurity incidents in Canadian financial services in recent memory - was first detected by CIRO on August 11, 2025. The regulator publicly disclosed the incident on August 18, 2025, after shutting down non-critical systems as a precautionary measure and launching a forensic investigation.
That investigation, which reportedly required approximately 9,000 hours to complete, confirmed in January 2026 that the exposed data included income information, dates of birth, government-issued identification numbers, phone numbers, Social Insurance Numbers, investment account numbers, and account statements. Login credentials such as passwords and PINs were not compromised.
The breach was traced to a phishing attack. Affected individuals included both retail investors and registered employees and executives of CIRO member firms, whose data was held as part of CIRO's regulatory and investigative activities.
The settlement terms
If the Superior Court of Québec approves the settlement, class members will have access to three forms of relief.
First, CIRO will provide two additional years of credit monitoring, identity protection services, and identity theft insurance through either Equifax Canada or TransUnion, or both - building on the credit monitoring CIRO had already offered affected individuals following the breach.
Second, class members who can document out-of-pocket expenses or losses directly tied to the cyber incident may claim reimbursement of up to CAD $10,000. Third, those who cannot or do not wish to submit documentation will receive an equal share of a separate pool set aside for undocumented claims. All payments are subject to proportional reduction if approved claims exceed available funds.
Class counsel for the settlement is Lex Group Inc., with Me David Assor acting as lead counsel. The firm launched the original class action against CIRO on October 6, 2025, on behalf of all persons in Canada affected by the breach.
A parallel action was subsequently filed in the Supreme Court of British Columbia on behalf of persons outside Québec. The proposed national settlement is intended to resolve both proceedings, with the B.C. action to be dismissed, permanently stayed, or discontinued as a condition of approval.
Key dates for class members
The settlement approval hearing is scheduled for January 14, 2027, at 9:30 a.m. at the Montréal courthouse, located at 1 Notre-Dame Street East, room 2.08, with a Microsoft Teams option also available.
Class members who wish to opt out of the settlement must submit an opt-out form to the Clerk of the Superior Court of Québec no later than December 15, 2026. Those who wish to object to the settlement terms without opting out must deliver a written submission to the settlement administrator by the same date. Class members who neither opt out nor make a timely objection will be bound by the court's decision and will need to submit a claim - at a later date to be determined - in order to receive compensation.
There is no cost to participate in the class action or proposed settlement. Class members can find information and updates at www.CIROSettlement.ca or by contacting Concilia Services Inc. toll-free at 1-866-617-5770.
For advisors whose clients have received notification from CIRO about the breach, this settlement represents a concrete pathway to compensation, though the amounts available to individual claimants will ultimately depend on the volume and nature of approved claims.
CIRO management previously said that the regulator doesn't expect the matter to exceed the amount covered by its insurance.
