The Wealthsimple data breach is real: on August 30, 2025, Wealthsimple detected that personal data belonging to less than 1% of Wealthsimple's clients had been accessed without authorization. This page sets out what Wealthsimple and Canada’s investment regulator have confirmed, how to tell whether you were affected, and which steps are worth taking now, including for the separate CIRO breach that is often mixed up with it, and where the Wealthsimple class action lawsuit over the breach stands. YieldMaple read Wealthsimple’s breach statement, its Help Centre security guidance and CIRO’s notices on September 24, 2026, and checked the lawsuit’s court filing, class counsel’s case page and Quebec’s class action registry on October 6, 2026. Every fact below comes from official Wealthsimple, CIRO, Government of Canada or court and class-counsel sources.
Wealthsimple data breach at a glance
| Feature | Wealthsimple incident | CIRO incident |
|---|---|---|
| Who was affected | less than 1% of Wealthsimple's clients (better on this row) | approximately 750,000 Canadian investors |
| Identified | August 30, 2025 | August 11, 2025 |
| Cause | a compromised software package written by a trusted third party | a sophisticated phishing attack |
| Data involved | contact details, government IDs provided at sign-up, financial details such as account numbers, IP address, Social Insurance Number or date of birth | dates of birth, phone numbers, annual income, Social Insurance Numbers, government-issued ID numbers, investment account numbers and account statements |
| Passwords and logins | no passwords were compromised | not at risk — CIRO doesn't collect passwords, security questions or PINs |
| How people were told | by email, with every notice sent by 10:30 a.m. ET on September 5, 2025 — no email means your data wasn't affected | Letters starting January 14, 2026, by email or Canada Post mail |
| Free protection offered | two years of free credit and dark-web monitoring, plus identity theft protection and insurance | two years of credit monitoring and identity theft protection through TransUnion and Equifax |
| Misuse reported so far | Not addressed in Wealthsimple's statement | none so far — CIRO says it has seen no sign the information was misused or made available on the dark web |
Sources: Wealthsimple Help Centre, 'An Important Security Update For Our Clients' (published September 5, 2025); CIRO's cybersecurity incident page, its media release of January 14, 2026 and its investor FAQ. Checked September 24, 2026.
The two incidents were identified 19 days apart, and both involved Social Insurance Numbers, which is why they get confused. They are separate events at separate organizations, with separate notices and separate protection offers.
What happened in the Wealthsimple data breach?
A compromised third-party software package let someone access personal data of less than 1% of Wealthsimple's clients without authorization, and Wealthsimple contained it within a few hours.
Here is the sequence Wealthsimple has published:
- August 30, 2025: Wealthsimple detects a data security incident. Its security team, working with outside experts, traces it to a compromised software package written by a trusted third party.
- Contained within a few hours: the unauthorized access lasted what Wealthsimple calls “a brief period”.
- September 5, 2025: Wealthsimple publishes “An Important Security Update For Our Clients” and finishes emailing every affected client that morning.
- Regulators: Wealthsimple says it informed all applicable privacy and financial regulators. The statement gives no date for this.
What the statement leaves out matters too. It doesn’t name the third party, it gives a percentage rather than a number of people, and it doesn’t describe the extra protections it says are now in place. YieldMaple also checked the statement’s Help Centre record: it was created on September 5, 2025, and its last-edited timestamp is from that same day, even though the page now shows a later “updated” date.
Was Wealthsimple hacked?
Yes, in the sense that someone accessed Wealthsimple client data without authorization, but no accounts were taken over, no passwords were compromised and no money was stolen.
Wealthsimple’s own wording is that no passwords were compromised and no funds were accessed or stolen, and all accounts remain secure.
“Hacked” can mean two different things, and each calls for a different response:
- A breach of company data (what happened here). Information about you leaks from a company’s systems or a supplier’s software. Your login still works and your money stays put, but the leaked details can fuel identity fraud and convincing scams long after the incident.
- An account takeover. Someone signs in to your account, often with a password or code tricked out of you. This is the risk you control directly, and it is serious even without a withdrawal: Wealthsimple notes that an intruder may be able to see your legal name, Social Insurance Number, address, email, phone number and portfolio holdings.
Wealthsimple’s help article on compromised accounts lists the warning signs: login notifications you didn’t trigger, logins from unfamiliar devices or locations, an unexpected trusted-device approval request, being unable to log in, unauthorized transactions on your bank statement, and no emails from Wealthsimple at all, which can be a sign that someone may have got into your email account and muted Wealthsimple's messages. If you see any of them, Wealthsimple’s first steps are to change your password in the app or on the website, contact Wealthsimple through its chat, review recent transactions and check that your security settings haven't changed.
What information was exposed?
Wealthsimple says the accessed data was personal information like contact details, government IDs provided at sign-up, financial details such as account numbers, IP address, Social Insurance Number or date of birth.
Per the statement, passwords were not compromised and no money was accessed. What each exposed item means in practice:
- Social Insurance Number, date of birth and ID details. Together, these are what a fraudster needs to try opening credit in your name. This is the main reason to watch your credit file.
- Contact details. An email address, phone number and home address let scammers reach you directly and greet you by name.
- Account numbers. They make a fake “Wealthsimple” message look authentic. A caller who reads out your account number has proven nothing about who they are.
How do you know if you were affected?
Wealthsimple told affected clients by email, with every notice sent by 10:30 a.m. ET on September 5, 2025 — no email means your data wasn't affected.
To check:
- Search your inbox, including spam and archived mail, for Wealthsimple messages sent between August 30 and September 5, 2025: Wealthsimple detected the incident on the first date and had sent every notice by the second. Wealthsimple’s real addresses include @wealthsimple.com (employees and support), @o.wealthsimple.com (transactional notifications) and @m.wealthsimple.com (marketing).
- If you find the notice, keep it. The dedicated support contact is in the notification email Wealthsimple sent to affected clients, and the Privacy Commissioner of Canada’s advice for any breach notice is to read it carefully and keep it in a safe place.
- If you find nothing, Wealthsimple’s position is that your data wasn’t part of this incident.
Be wary of any new message saying you have just been found to be affected. Wealthsimple says every notice had gone out by September 5, 2025, so verify any breach-related message inside the Wealthsimple app before you act on it.
What should you do now if your data was exposed?
Start with the two years of free monitoring Wealthsimple offered, then add a fraud alert, a passkey and firm skepticism toward any call, text or email that mentions Wealthsimple.
YieldMaple’s checklist, in order of impact:
- Use the monitoring. Affected clients get two years of free credit and dark-web monitoring, plus identity theft protection and insurance. If you never set it up, contact the dedicated support team named in the notice email. If you enrolled when the notices went out, coverage ends around September 2027, so put a reminder in your calendar now.
- Place a fraud alert. CIRO’s investor FAQ points to a fraud alert with Equifax or TransUnion, which tells lenders to take extra steps to verify your identity before granting credit. That is CIRO’s advice to investors caught in its own breach, and it fits this one too. The Privacy Commissioner’s breach guidance also says to consider subscribing to credit alerts or ordering a credit report.
- Set up a passkey and switch two-step verification to an authenticator app. Wealthsimple calls a passkey one of the best ways to protect your Wealthsimple profile, and it replaces the two-factor code at login, and its Account Guarantee depends on one (details below). An authenticator app is a stronger form of two-factor authentication than SMS, according to Wealthsimple. Wealthsimple’s breach statement also says never to reuse passwords.
- Ask for a withdrawal block if you want extra certainty. Wealthsimple can add an account lock, a withdrawal block or a crypto withdrawal block. The withdrawal block stops all outflows from an account (cash withdrawals, transfers and crypto withdrawals) while trading and deposits keep working. A restriction is added by Wealthsimple's support team after you ask in a chat from the app or website — you can't add one yourself, and most requests are handled within one business day, once Wealthsimple has verified your identity.
- Treat every call, text and email that mentions Wealthsimple as unverified. Leaked contact details and account numbers are exactly what make a scam sound real. Wealthsimple will never ask for your password or authentication codes, or to move money, and a call from a real Wealthsimple number doesn't prove the caller works for Wealthsimple, because numbers can be spoofed.
- Protect your phone number. Contact details can include your mobile number, so ask your carrier whether it offers a PIN or extra verification before anyone can move your number to a new SIM card.
- Ignore anyone offering to get money back. Wealthsimple’s scam guide says don't respond to or contact anyone offering to help you recover lost funds.
- Keep watching after the monitoring ends. The Privacy Commissioner advises you to stay vigilant, because fraudsters may wait before trying to steal your information. If your identity is misused, Wealthsimple’s advice is to file a police report with your local police right away. Its scam guide names the Canadian Anti-Fraud Centre (CAFC) and/or your local police as the places to report a scam.
Is the CIRO breach the same as the Wealthsimple breach?
No: CIRO, the regulator that oversees Canada’s investment dealers, had its own breach, identified on August 11, 2025, which affected approximately 750,000 Canadian investors.
CIRO (the Canadian Investment Regulatory Organization) says the cause was a sophisticated phishing attack. The investor information that may have been affected includes dates of birth, phone numbers, annual income, Social Insurance Numbers, government-issued ID numbers, investment account numbers and account statements. Login details were not at risk — CIRO doesn't collect passwords, security questions or PINs.
CIRO says only some clients or former clients of CIRO-regulated dealers were affected. It held their information because of its own regulatory work, such as investigations, compliance reviews and market surveillance, and CIRO says the data was copied from its own system. Wealthsimple’s dealer is Wealthsimple Investments Inc. (WSII), a member of the Canadian Investment Regulatory Organization (CIRO) and the Canadian Investor Protection Fund (CIPF), so a Wealthsimple client can be among those affected, just like a client of any other CIRO-regulated dealer.
How CIRO handled it:
- Notices went out starting January 14, 2026, by email or Canada Post mail. The final notices went out in late March to early April 2026 (CIRO says no more notifications are coming).
- Affected investors were offered two years of credit monitoring and identity theft protection through TransUnion and Equifax.
- Evidence of misuse: none so far — CIRO says it has seen no sign the information was misused or made available on the dark web.
- CIRO says it won’t contact you by text message or social media, and it won't ask for access to your investment or bank accounts or for any payment.
- If you didn’t get a letter and want to check, ask CIRO in writing, using the contact form in the cyber incident section of ciro.ca.
How to tell the two apart: a Wealthsimple notice came by email from Wealthsimple no later than September 5, 2025; a CIRO letter came from CIRO, by email or post, from January 2026 onward. If you received both, you were caught in two separate incidents, and the checklist above covers both.
Did anyone lose money in the Wealthsimple breach?
No, according to Wealthsimple: its statement says no funds were accessed or stolen, and all accounts remain secure.
The breach exposed data, not logins. Going forward, two different protections matter, and they cover different risks:
- The Account Guarantee covers reimbursement of direct losses from unauthorized transactions in your accounts, as long as you use passkeys on all your devices and meet the guarantee's security responsibilities. You must report problems immediately, and no later than 10 days after you receive the monthly statement showing the unauthorized transaction. It excludes credit card, corporate and Wealthsimple Predict accounts, and self-custody wallets, and it won’t pay for indirect losses such as missed payments, NSF and other administrative fees, or lost profit and opportunity.
- CIPF is a separate backstop. Wealthsimple’s investment accounts are protected by CIPF within specified limits if Wealthsimple Investments Inc. becomes insolvent. It exists for a failed dealer, not for a scam or a hijacked login.
If you hold crypto at Wealthsimple, it is not protected by CIPF, CDIC or any other investor protection insurance scheme. Wealthsimple describes its crypto withdrawal block as the option for people specifically worried about crypto being moved off the platform. The Wealthsimple Crypto review covers fees and coins.
Is there a Wealthsimple class action lawsuit?
Yes: a proposed class action over the data breach was filed against three Wealthsimple companies in the Supreme Court of British Columbia on September 23, 2025.
| Feature | Data breach class action | Crypto-fee class action (Quebec) |
|---|---|---|
| Court and file | Supreme Court of British Columbia, Vancouver Registry, file no. S-257192 (better on this row) | Superior Court of Quebec (Montréal), file no. 500-06-001199-229 |
| What it's about | Alleged data breach through a supply-chain attack on a software package supplied to Wealthsimple by a third-party vendor | alleged commissions and/or fees charged for buying and selling cryptocurrency on Wealthsimple's platform |
| Law firm for the class | Slater Vecchio LLP | LPC Avocats |
| Status per the source | Filed September 23, 2025; described by class counsel as a proposed class action | Settlement agreement for $750,000; registry lists a "Judgment on out-of-court settlement" dated June 22, 2025 and a partial closing judgment ("Jugement de clôture partielle") dated March 3, 2026 |
Sources: the court-stamped notice of civil claim and Slater Vecchio LLP's case page; Quebec's Registry of class actions (file 500-06-001199-229) and the court-approved settlement notice published by LPC Avocats. Checked October 6, 2026.
The court filing. The notice of civil claim was filed in the Supreme Court of British Columbia, Vancouver Registry, file no. S-257192, carries the registry’s stamp dated September 23, 2025 and is brought under British Columbia's Class Proceedings Act. It names Wealthsimple Inc., Wealthsimple Investments Inc. and Wealthsimple Technologies Inc. as defendants. The law firm acting for the plaintiff is Slater Vecchio LLP.
What the lawsuit alleges. Per the firm’s case page, the claim alleges that the breach resulted from a supply-chain attack on a software package supplied to Wealthsimple by a third-party vendor, and that names, addresses, Social Insurance Numbers, account numbers, government-issued identification and IP addresses were accessed and stolen. These are allegations in a claim, not findings by a court.
Who the proposed class covers. The claim seeks to represent all Canadians whose information was accessed in the breach, with a subclass for Canadians who suffered direct harm, such as financial losses, identity theft or fraud, tied to the misuse of their compromised data.
Where the case stands. YieldMaple checked Slater Vecchio’s case page on October 6, 2026: it still describes the case as a proposed class action and lists one court document, the notice of civil claim. Before a proposed class action can go ahead, the person who files the claim must ask the court for permission to proceed as a class action, called certification outside Quebec and authorization in Quebec, per the same page. The page does not report a certification decision, a settlement or a claims process. It does carry a contact form that asks whether you received Wealthsimple’s breach email, and it states that contacting the firm does not create a solicitor-client relationship.
Because no settlement or payout appears on class counsel’s page, treat any call, text or email offering you “Wealthsimple lawsuit” money with the same caution as the fake breach messages described below.
The earlier Quebec class action over crypto fees (not the breach)
A separate class action, about crypto trading fees rather than the breach, led to a settlement agreement with Wealthsimple. Class counsel is LPC Avocats, and the case sits in the Superior Court of Quebec (Montréal), file no. 500-06-001199-229 and concerned alleged commissions and/or fees charged for buying and selling cryptocurrency on Wealthsimple's platform. The court authorized it against Wealthsimple for settlement purposes only on May 14, 2025, and Wealthsimple agreed to pay $750,000. The court-approved notice states that Wealthsimple denies any wrongdoing, and the settlement is not an admission of liability.
The Wealthsimple class in that settlement covered individuals with a listed residential address in Quebec who paid fees to buy or sell cryptocurrency through Wealthsimple's app or website between August 1, 2020 and October 17, 2023. The notice set June 17, 2025 as the opt-out deadline and July 31, 2025 as the date by which class members who had left Wealthsimple, or no longer had an active crypto or cash account there, had to send their contact details to class counsel to be paid; both dates have passed. Quebec’s class action registry lists a "Judgment on out-of-court settlement" dated June 22, 2025 and, most recently, a partial closing judgment ("Jugement de clôture partielle") dated March 3, 2026.
How do you spot a fake Wealthsimple breach message?
Treat any message about the breach as fake until you’ve checked it inside the Wealthsimple app, because the leaked contact details make targeted scams easier.
Wealthsimple’s own guidance gives you four checks:
- The sender’s full address. Wealthsimple’s main email domains are @wealthsimple.com (employees and support), @o.wealthsimple.com (transactional notifications) and @m.wealthsimple.com (marketing); its scam guide lists a few more for newsletters, gifts, credit card and Interac e-Transfer notices, and mortgage applications. Check the address itself, not the display name.
- What it asks for. Wealthsimple says it will never ask for your password or authentication codes, or to move money, and it won’t ask you to download a screen-sharing tool or give anyone remote access to your computer, tablet or phone.
- Caller ID. It proves nothing: a call from a real Wealthsimple number doesn't prove the caller works for Wealthsimple, because numbers can be spoofed.
- The login page. Wealthsimple’s scam guide says to check that the web address matches my.wealthsimple.com/app before you log in, or simply to open the app instead of following a link.
Is Wealthsimple safe to use after the breach?
Wealthsimple says no client funds were accessed or stolen, and its investment accounts are still protected by CIPF within specified limits if Wealthsimple Investments Inc. becomes insolvent. The breach was about personal data, not money.
What the incident does show is supplier risk: the weak point was a compromised software package written by a trusted third party, rather than client logins. Wealthsimple detected it, contained it within a few hours, published its statement six days after detection, and offered affected clients two years of free credit and dark-web monitoring, plus identity theft protection and insurance. It also says it has already enhanced protections against any similar threats, though it hasn’t said what changed.
For the full safety picture, including regulation, CIPF limits and CDIC coverage on chequing, see is Wealthsimple safe and our complete Wealthsimple guide.
The verdict: should you stay with Wealthsimple after the breach?
For most clients, the breach alone isn’t a reason to leave: closing an account doesn’t undo exposure that has already happened, and no money was taken.
Staying with (or opening) Wealthsimple makes sense if:
- You want $0 commissions on listed Canadian and US stocks and ETFs at a dealer that is a CIPF member. The Wealthsimple Trade review covers the costs that do apply.
- You’ll set up a passkey on every device, which the Account Guarantee requires along with its other security responsibilities.
- You’re comfortable handling your own identity protection: monitoring, a fraud alert and a skeptical eye on unexpected calls.
Look elsewhere if:
- A disclosed breach involving SINs is a dealbreaker for you. That is a legitimate personal line; just know that the separate CIRO breach affected clients of CIRO-regulated dealers rather than one firm, so no brokerage choice guarantees your data never leaks.
- You don’t want to use passkeys; without them, the Account Guarantee doesn’t apply.
- You’d rather keep your investments inside the bank you already use. Wealthsimple alternatives in Canada compares the options.
This page is general education, not financial or legal advice. If you think your identity has been misused, contact your local police and the Canadian Anti-Fraud Centre, as Wealthsimple advises.