This guide brings together and replaces our earlier news posts on Canadian data breaches and cyberattacks from 2017 to 2024, rewritten and expanded in October 2026 as a sourced reference.
Between late 2017 and spring 2024, a car lender, Canada's largest telecom company, two major banks, the country's biggest payment processor, a national discount retailer and three federal bodies all reported serious cyber incidents. Some exposed the personal details of hundreds of thousands of customers. Others knocked government systems offline for months. Taken together, they show how varied the risk is: extortion of banks, ransomware gangs that leak data, a breach that started at a marketing vendor, and intrusions into federal networks.
The threat has not eased since. In its National Cyber Threat Assessment 2025-2026, the Canadian Centre for Cyber Security says ransomware is "the top cybercrime threat facing Canada's critical infrastructure." This guide sets out each case in order: what happened, the impact as reported by the organization or major outlets, how it responded, and what happened next. It finishes with practical steps for anyone whose data turns up in a breach, and lessons for organizations.
In this guide
- The cases at a glance
- December 2017: Nissan Canada Finance
- May 2017 and January 2018: Bell Canada, twice
- May 2018: BMO and Simplii Financial
- November 2018: mandatory breach reporting arrives
- November 2023: Moneris and the Medusa gang
- January 2024: Global Affairs Canada
- February 2024: the RCMP
- March 2024: FINTRAC
- March to April 2024: Giant Tiger
- What this means for you and for organizations
- FAQ
The cases at a glance
The timeline below runs from the first case to the latest follow-up we could confirm. Dates are those given by the organizations, regulators or the outlets listed in the sources.
- May 2017
Bell Canada says about 1.9 million customer email addresses and about 1,700 names and phone numbers were accessed. - Dec 11, 2017
Nissan Canada Finance becomes aware of unauthorized access to customer data, later putting the figure at up to 1.13 million people. - Late Jan 2018
Bell discloses a second breach affecting fewer than 100,000 customers. The RCMP investigates. - May 27-28, 2018
BMO and CIBC's Simplii Financial say fraudsters may have accessed data on up to 90,000 customers combined. Attackers demand $1 million from each bank. - Nov 1, 2018
Mandatory breach reporting under PIPEDA, Canada's federal private-sector privacy law, takes effect. - April 2021
An Ontario court approves class-action settlements of $21.2 million (BMO) and $1.8 million (CIBC) over the 2018 thefts. - November 2023
The Medusa ransomware gang lists Moneris on its leak site and demands $6 million. Moneris later confirms data from a corporate shared drive was released. - Dec 20, 2023 to Jan 24, 2024
Unauthorized users are inside Global Affairs Canada's VPN. The department partly shuts remote access on Jan. 24. - Late February 2024
The RCMP discloses a "cyber event" on its networks and opens a criminal investigation. - Feb 26, 2024
The Privacy Commissioner opens an investigation into the Global Affairs breach. - Mar 2, 2024
FINTRAC detects a cyber incident and takes its corporate systems offline. - Mar 4, 2024
Giant Tiger learns that a vendor handling customer communications was breached. - Apr 12, 2024
About 2.8 million Giant Tiger records appear on a hacker forum and are added to Have I Been Pwned. - Late August 2024
FINTRAC's web reporting system comes back after roughly five and a half months offline. - Mar 31, 2025
Deadline for businesses to file reports backlogged during the FINTRAC outage.
| Case | Sector | What was exposed or disrupted | Reported scale | Outcome |
|---|---|---|---|---|
| Nissan Canada Finance (Dec 2017) | Auto finance | Names, addresses, vehicle details, VINs, credit scores, loan amounts, monthly payments | Up to 1.13 million customers | 12 months of free TransUnion credit monitoring offered |
| Bell Canada (May 2017, Jan 2018) | Telecom | Email addresses, names, some phone numbers, user names and account numbers | 1.9 million emails (2017); under 100,000 customers (2018) | RCMP investigation; Bell says it added security measures |
| BMO and Simplii (May 2018) | Banking | Names, dates of birth, social insurance numbers, account details | Up to 90,000 at first; later class actions covered 113,000+ BMO and 10,000+ Simplii clients | Banks refused ransom; $23 million in court-approved settlements |
| Moneris (Nov 2023) | Payments | Merchant IDs, issue logs, names and addresses tied to legacy gift cards | Not stated | Data from a corporate shared drive released by Medusa |
| Global Affairs Canada (Dec 2023 to Jan 2024) | Federal government | Staff personal information, emails, calendars, contacts | Not stated | Privacy Commissioner investigation |
| RCMP (Feb 2024) | Federal policing | Breach of RCMP networks; scope under investigation | Not stated | Criminal investigation; RCMP said operations were not affected |
| FINTRAC (Mar 2024) | Federal financial intelligence | Corporate systems taken offline; no evidence data was removed | Web reporting down about five and a half months | Backlog deadline of Mar 31, 2025 |
| Giant Tiger (Mar to Apr 2024) | Retail | Names, emails, phone numbers, physical addresses | 2.8 million records (Have I Been Pwned) | No payment data or passwords involved, per the company |
Figures are as reported by each organization, court or the outlets in the sources. "Not stated" means no official number was published.
December 2017: Nissan Canada Finance
What happened
On December 11, 2017, Nissan Canada Finance, the lending arm that finances Nissan and Infiniti vehicles in Canada, became aware that someone had gained unauthorized access to customer personal information. It began notifying customers about ten days later, by email and with a security notice on its website. The company said it was still investigating exactly which records had been touched.
The impact
Nissan Canada Finance said up to about 1.13 million current and past customers who financed a vehicle through it or through Infiniti Financial Services Canada could be affected. The data at risk included names, addresses, vehicle make and model, vehicle identification numbers (VINs), credit scores, loan amounts and monthly payments. The company said it had no indication that payment card information was involved, or that customers who financed vehicles outside Canada were affected.
The response
The company offered affected customers 12 months of free credit monitoring through TransUnion and said it was working with law enforcement. Because the full scope was not yet known, it notified the whole customer base rather than waiting to narrow the list.
What happened next
Lending data matters even without card numbers. A credit score, loan balance and monthly payment are exactly what a scammer needs to pose convincingly as the lender, so customers were best served by treating unexpected calls about their loan as suspect.
May 2017 and January 2018: Bell Canada, twice
What happened
Bell Canada, the country's largest telecommunications company, reported two separate breaches within about eight months. The first was disclosed in May 2017. In late January 2018 it disclosed a second, smaller incident in which hackers illegally accessed some customer information.
The impact
In the first breach, Bell said about 1.9 million customer email addresses and about 1,700 names and phone numbers were accessed. In the second, it said fewer than 100,000 customers were affected. The data included names and email addresses and, in some cases, phone numbers, user names or account numbers. Bell said there was no indication that credit card or other banking information was accessed in either incident.
The response
For the January 2018 breach, Bell said it was contacting the customers involved and had notified the appropriate government agencies, including the Office of the Privacy Commissioner. Police opened an investigation. In its notices, Bell said it had put new security and identity and access management measures in place.
What happened next
Neither incident involved financial data, but an email that quotes your real account number is far more convincing than a generic one, which makes this kind of leak a strong starting point for phishing.
May 2018: BMO and Simplii Financial
What happened
On Monday, May 28, 2018, two Canadian banks announced separate but apparently related incidents. Simplii Financial, CIBC's direct-banking brand, said it had learned over the weekend that fraudsters may have electronically accessed personal and account information for about 40,000 of its clients. About an hour later, the Bank of Montreal (BMO) said it had been contacted on the Sunday by people claiming to hold the personal data of some of its customers. BMO said it believed the attack came from outside Canada and appeared to be linked to the Simplii incident.
The attackers then emailed Canadian media outlets. They demanded $1 million from each bank by 11:59 p.m. and threatened to release or sell the data. To prove their claim, they included samples of customer records, which at least one customer contacted by reporters confirmed were accurate.
The impact
Reports at the time put the total at up to 90,000 customers: about 40,000 at Simplii and fewer than 50,000 at BMO. The data reportedly included names, dates of birth, social insurance numbers and account balances. That combination is far more dangerous than a list of email addresses, because a SIN and date of birth can be used to apply for credit in someone else's name.
The response
Both banks refused to pay. BMO said its practice was "not to make payments to fraudsters" and that the exposures it had identified had been closed off. Both banks contacted authorities, said they would reach out to affected customers, offered support including credit monitoring, and urged clients to watch their accounts closely.
What happened next
Class actions followed in Ontario. According to a 2021 report in Advisor.ca, the Ontario Superior Court of Justice approved settlements of $21.2 million with BMO and $1.8 million with CIBC. The classes covered more than 113,000 BMO clients and more than 10,000 Simplii clients, larger than the early estimates. Payments were tiered by how much personal information had been exposed, with more for people whose SIN and date of birth were compromised. Separately, the banks had already reimbursed fraudulent transfers, about $6.85 million at BMO and $1.8 million at CIBC.
November 2018: mandatory breach reporting arrives
The three private-sector cases above all happened before Canada had a federal duty to report breaches. That changed on November 1, 2018, when breach reporting rules under PIPEDA, the Personal Information Protection and Electronic Documents Act, came into force.
- The test. An organization must report a breach to the Office of the Privacy Commissioner (OPC) and notify affected people when the breach creates a "real risk of significant harm." Harm includes identity theft, financial loss, humiliation and damage to reputation.
- Records for every breach. Organizations must keep a record of every breach of security safeguards involving personal information, even when it doesn't meet the reporting test, and keep it for two years.
- Penalties. Knowingly breaking the reporting, notification or record-keeping rules is an offence, with fines of up to $100,000.
PIPEDA covers private businesses. Federal departments such as Global Affairs Canada fall under the separate Privacy Act, and several provinces have their own privacy laws.
November 2023: Moneris and the Medusa gang
What happened
Moneris Solutions is a major Canadian payment processor whose network supports the card terminals used by retailers across the country. In November 2023, the Medusa ransomware gang listed Moneris on its leak website and posted screenshots of what it said was stolen data. A Canada-based threat researcher at the security firm Emsisoft drew public attention to the listing. Medusa demanded $6 million to delete the data and said it would publish it in eight days otherwise.
The impact
Moneris initially said an external party had attempted an attack and that its cybersecurity team had prevented access to any critical data. It said a full audit found that none of its data-loss prevention policies had been triggered. Later in November, Medusa posted the data it claimed to have, saying it included employee and client account and email information, ID numbers, contracts, presentations and financial transaction reports. Those are the gang's claims and were not independently confirmed.
The response
When asked again by IT World Canada, Moneris pointed to an updated statement on its website. That statement acknowledged that the gang had accessed and released data from a corporate shared drive, including merchant IDs, issue logs, and names and addresses related to legacy gift cards. Moneris maintained that its critical systems had not been compromised.
What happened next
The case follows the usual pattern of a modern extortion gang: a public claim, a countdown and sample files to add pressure. It also shows that a company can block the damaging part of an attack and still have files stolen.
January 2024: Global Affairs Canada
What happened
Global Affairs Canada (GAC), the department responsible for foreign affairs, trade and development, detected malicious cyber activity on its internal network in January 2024. On January 24 it deliberately cut off part of its remote access to deal with the problem, and some staff were told not to work remotely. According to the Office of the Privacy Commissioner, unauthorized individuals had gained access to the department's virtual private network (VPN), the system employees use to connect securely to headquarters in Ottawa. CBC News, citing internal emails, reported that the breach affected the network from December 20, 2023, to January 24, 2024. Another report citing a government email gave December 30 as the start of the at-risk window.
The impact
GAC said early results showed unauthorized access to the personal information of users, including employees. Reports described at least two internal drives being affected, along with the emails, calendars and contacts of many staff. No public figure was given for the number of people affected. GAC said critical services and external communications kept running, and that it could not share more details "for operational and security reasons."
The response
The department said it was contacting affected people and had reported the breach to the Office of the Privacy Commissioner. It worked with Shared Services Canada and the Canadian Centre for Cyber Security, part of the Communications Security Establishment, to restore connectivity.
What happened next
On February 26, 2024, the OPC announced a formal investigation after receiving several complaints. It said it would examine whether GAC's safeguards for personal information were adequate and whether the department complied with the Privacy Act. GAC had also been hit by an earlier cyberattack, detected in January 2022, which raised questions from security experts about whether the network had been fully cleaned up after the first incident. No attribution for the 2024 breach had been made public in the sources we reviewed.
February 2024: the RCMP
What happened
In late February 2024, the Royal Canadian Mounted Police said it was dealing with a breach of its networks and had opened a criminal investigation to establish its scope. Its chief security officer described a "cyber event" in a message to staff and urged employees to stay vigilant, according to CBC reporting.
The impact
The RCMP said the situation was evolving quickly, but that there was no impact on its operations and no known threat to the safety and security of Canadians. It also said there was no indication that foreign police or intelligence services were affected. No details about what data, if any, was taken have been published in the sources we reviewed.
The response
The RCMP notified the Office of the Privacy Commissioner and said it was working with Shared Services Canada, the Canadian Centre for Cyber Security and other federal partners.
What happened next: the website outage
Around the same time, the RCMP's main website was unreachable. On February 25 it returned an error page and redirected to a setup page normally seen only on a brand-new site, which led many, including us in our original post, to wonder whether the two events were connected. The RCMP later said they were not. It attributed the website outage to high traffic overloading servers managed by Shared Services Canada, and the site was back early on February 26. It is a useful reminder not to assume that every outage during a breach is part of the attack.
March 2024: FINTRAC
What happened
The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is the country's financial intelligence unit. Banks, money services businesses, casinos, real estate firms and others file reports with it on suspicious and large transactions, and it passes intelligence to police. On March 2, 2024, FINTRAC detected a cyber incident affecting its own systems. As a precaution, it took its corporate systems offline. An official from the Canadian Centre for Cyber Security later said a "malicious actor" had gained unauthorized access.
The impact
FINTRAC said from the start that the incident did not involve its intelligence or classified systems. In a March 22 update, it said forensic work with the Cyber Centre and other federal agencies had found no evidence that information was removed or lost. No group publicly claimed the attack in the sources we reviewed.
The disruption was long, though. The Logic reported that FINTRAC's web reporting system stayed down until late August 2024, about five and a half months. The online registry for money services businesses was also unavailable for months, which affected licence renewals. Large financial institutions, which file 96% of reports, kept filing through a secure data feed. Smaller money services businesses, many without access to that feed, built up months of unfiled reports.
The response and what happened next
FINTRAC worked with federal partners to restore operations and said most systems were back by fall 2024. Businesses were given until March 31, 2025, to file backlogged reports. The case is a lesson in how a breach with no confirmed data loss can still cause serious operational harm to the businesses that depend on a system.
March to April 2024: Giant Tiger
What happened
Giant Tiger is a Canadian discount retail chain. In March 2024 it told customers that it had learned, on March 4, of a security problem at a third-party vendor it used to manage customer communications and engagement. Contact information for certain customers had been accessed without authorization. The company did not name the vendor.
The impact
On April 12, 2024, someone posted what they called the full Giant Tiger customer database on a hacker forum, claiming 2.8 million records. Downloading it cost a few forum credits, which members can earn easily, so the data was effectively free to anyone who wanted it. The breach notification service Have I Been Pwned added the data set the same day, with 2,842,669 email addresses. It listed names, email addresses, phone numbers and physical addresses as the exposed data. Have I Been Pwned also reported that 46% of the addresses were already in its database from earlier breaches.
The response
Giant Tiger notified affected customers and said no payment information or passwords were involved. It declined to identify the vendor, citing the investigation and security concerns.
What happened next
Even without payment data, names, addresses and emails from a familiar retailer make convincing phishing bait. The case also shows how much customer data now sits with marketing vendors rather than with the retailer itself.
What this means for you and for organizations
If your data was in one of these breaches
- Check whether your email address appears. Have I Been Pwned lets you search an email address for free across known breaches, including Giant Tiger. You can also sign up to be told about future breaches.
- Expect targeted phishing. Most of these leaks included names, emails, phone numbers or account details. Treat calls, texts and emails that mention a breach, a refund or a "security check" as suspicious. Call the company back on a number from a statement or its official site.
- If your SIN or date of birth was exposed, protect your credit. Accept any free monitoring the company offers. Nissan, for example, offered TransUnion monitoring, and the banks offered it in 2018. Canada's two national credit bureaus are Equifax and TransUnion. Contact both to ask about putting a fraud alert on your file and to review your credit report.
- Change reused passwords and turn on two-step sign-in. None of these breaches was reported to include passwords, but criminals often combine leaks. A unique password and a second sign-in step stop most account takeovers.
- Report fraud. If someone uses your information, report it to your local police and to the Canadian Anti-Fraud Centre, and tell your bank right away.
For organizations
| Lesson | Where it showed up | What to do |
|---|---|---|
| Vendors hold your customers' data too | Giant Tiger (communications vendor) | Inventory which vendors hold personal data, limit what they get, and write breach notice duties into contracts. |
| Remote access is a front door | Global Affairs Canada (VPN) | Require multi-factor sign-in on VPNs and remote tools, and watch for logins from unusual places. |
| Stopping encryption is not stopping theft | Moneris (shared drive) | Restrict and monitor shared drives, and plan for data being published even if systems stay up. |
| Outages hurt the people who depend on you | FINTRAC (5.5 months of web reporting downtime) | Keep backup channels for critical services, and communicate often with affected users. |
| Extortion demands come with a deadline | BMO and Simplii ($1 million each) | Decide your ransom policy and communications plan before an incident, not during one. |
| The law requires records and notice | All private-sector cases after Nov 1, 2018 | Keep a log of every breach for two years and report to the OPC when there is a real risk of significant harm. |
FAQ
What was the biggest data breach in this list?
By number of records, Giant Tiger's 2024 vendor breach was the largest, with about 2.8 million records listed by Have I Been Pwned. By sensitivity, the 2018 BMO and Simplii thefts were arguably more serious, because they reportedly included social insurance numbers and dates of birth.
Did BMO or Simplii pay the ransom?
No. Both banks refused, and BMO said its practice was not to pay fraudsters. They later settled class actions for a combined $23 million, approved by an Ontario court.
Was the RCMP website outage part of the cyberattack?
According to the RCMP, no. It said the February 2024 website outage was caused by high traffic overloading servers, and was unrelated to the cyber event on its networks.
Do Canadian companies have to tell me about a breach?
Since November 1, 2018, organizations covered by PIPEDA must notify affected people and the Privacy Commissioner when a breach creates a real risk of significant harm. Federal government bodies fall under the Privacy Act, and some provinces have their own laws.
Who was behind these attacks?
In most cases no attacker has been publicly identified by authorities in the sources we reviewed. The Moneris incident was claimed by the Medusa ransomware gang. The other attacks had no public claim or official attribution.
Sources
- Canadian Centre for Cyber Security: National Cyber Threat Assessment 2025-2026 (announcement)
- Security Affairs: Nissan Finance Canada hacked, 1.13 million customers may have been exposed
- Dark Reading: Bell Canada hit with 2nd breach in 8 months
- ESET WeLiveSecurity: Two Canadian banks warn attackers may have stolen customer data
- Malwarebytes: Two major Canadian banks blackmailed after alleged data breach
- Advisor.ca: Court approves multimillion-dollar settlements with BMO, CIBC over data breach
- TDS Law: Mandatory federal security breach reporting requirements in effect
- IT World Canada: Moneris says no "critical" data affected in ransomware gang's attack
- IT World Canada: Cyber Security Today, Nov. 27, 2023
- IT Business: Canadian government investigating another hack at Global Affairs
- Office of the Privacy Commissioner of Canada: investigation into Global Affairs Canada breach (Feb. 26, 2024)
- MobileSyrup: Privacy commissioner investigating Global Affairs breach
- BleepingComputer: RCMP investigating cyber attack as its website remains down
- FINTRAC: Statement, March 22, 2024
- The Logic: Fintrac hack fallout for businesses
- BleepingComputer: Hacker claims Giant Tiger data breach, leaks 2.8M records online
- Have I Been Pwned: Giant Tiger
Top image: "Server racks, one empty - IMG 3636" by Jemimus, CC BY 2.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments