Proposed CIRO Cyber Incident Class Action Settlement

On October 6, 2025, a national class action was commenced in the Superior Court of Québec against the Canadian Investment Regulatory Organization (“CIRO”) by Mr. Ovadia (the “Plaintiff”). The Plaintiff was asking the Court to determine whether CIRO committed faults in relation to preventing and responding to the Cyber Incident, including as concerns the storage and the safekeeping of Class Members’ personal information, alleged delayed notification of Class Members and alleged deficiencies of the notices and information sent to Class Members following the Cyber Incident.

On September 22, 2026, the Honourable Justice Martel of the Superior Court of Québec authorized the bringing of this class action against CIRO for settlement purposes only on behalf of the following national class:

All persons in Canada whose personal or financial information was held by Defendant [CIRO] and was compromised in the Cyber Incident which began on or about August 6, 2025, and who were sent an email or letter from Defendant [CIRO] informing them of such Cyber Incident.

CIRO denies all allegations and any liability in respect to the Plaintiff’s claim and the Cyber Incident. The parties have agreed to settle to avoid the risks, costs, and delay of continued litigation.

Settlement approval hearing

A settlement approval hearing before the Superior Court of Québec will be held on January 14, 2027, at 9:30am, at the Montreal courthouse located at 1 Notre-Dame Street East, Montreal, Québec, in room 2.08 (or another room to be determined by the Court thereafter), or via a Microsoft Teams link.

Class Members who do not oppose the proposed Settlement Agreement do not need to appear at any hearing or take any other action to indicate their desire to support the proposed Settlement Agreement. They will have to make a claim at a later date, if the settlement is approved and becomes effective, in order to receive compensation. You have nothing to pay.

British Columbia proposed class action

There is a proposed class action in British Columbia which also concerns the Cyber Incident experienced by CIRO: Harveer Singh and Yvan Silva v. Canadian Investment Regulatory Organization, Supreme Court of British Columbia, file no. VLC-S-S-261171. That proposed class action, filed on or about February 13, 2026, has not been certified as a class action, and is for a national class excluding Québec residents. The release resulting from the Settlement Agreement covers persons and claims across Canada, including those that are the object of the class action in British Columbia and the parties in Québec intend to work together to ensure the Settlement Agreement is enforced and to obtain the dismissal, permanent stay, or discontinuance of the British Columbia class action for the Settlement Agreement to come into force.

The Settlement has not yet been approved. The Claim Forms and the instructions for requesting Additional Credit Monitoring are not yet available; they will be posted on this website if the Settlement is approved and becomes effective.

The class action was authorized for settlement purposes only on behalf of the following national class:

All persons in Canada whose personal or financial information was held by Defendant [CIRO] and was compromised in the Cyber Incident which began on or about August 6, 2025, and who were sent an email or letter from Defendant [CIRO] informing them of such Cyber Incident.

If you wish to be included in the class action, you have no action to take at this stage and nothing to pay.

Keep your Unique ID. The notice sent to Class Members by mail or email contains a Unique ID, which you will need to submit a claim once the Claim Form becomes available.

The parties to this class action have reached a proposed national settlement (the “Settlement Agreement”), which applies to Class Members across Canada, subject to obtaining the approval of the Superior Court of Québec and the dismissal, permanent stay, or discontinuance of the putative class proceedings on behalf of a non-national class which have been filed against CIRO by Harveer Singh and Yvan Silva in the Supreme Court of British Columbia, file No. VLC-S-S-261171. The Settlement Agreement proposes to be the exclusive remedy in Canada for all claims of Class Members across Canada in relation to the Cyber Incident.

Under the terms of the Settlement Agreement, CIRO has agreed to pay a total of eight million three hundred thousand Canadian dollars (CAD $8,300,000) (the “Settlement Amount”). After accounting for class counsel fees, disbursements, administrative costs, and notice costs, the total amount available for Class Consideration (CAD $4,437,500) will be distributed in accordance with the structure outlined below:

a) Additional Credit Monitoring

First, (and in addition to the 2-year credit monitoring, identity theft protection services, and identity theft insurance with both Equifax and TransUnion already offered to all Class Members in the CIRO letter notifying them of the Cyber Incident), an amount of seven hundred thousand Canadian dollars (CAD $700,000) is reserved in priority for Class Members who make a direct request to CIRO to receive a redemption code for an additional two years of credit monitoring, identity theft protection services, and identity theft insurance from either Equifax or TransUnion (or both), on a first-come, first-served basis, over and above the credit monitoring services already offered by CIRO in the Cyber Incident notifications. The Settlement Website will provide instructions about how Additional Credit Monitoring may be requested from CIRO within 90 days of the Effective Date.

b) Documented Claims

Second, a minimum of one million four hundred ninety-seven thousand Canadian dollars (CAD $1,497,000) is reserved for Documented Claims (plus any unused amounts from Additional Credit Monitoring amount above) for Class Members to seek reimbursement of documented out-of-pocket expenses or documented losses suffered directly as a result of the receipt of CIRO’s notice letter(s) of the Cyber Incident, and/or the Cyber Incident itself, and which are supported by statements, receipts, or invoices or other documented proof of Compensable Expenses (defined as those associated with Class Members protecting themselves after learning of the Cyber Incident), up to CAD $10,000 per Claimant.

• To be valid, Documented Claims must be submitted by a Class Member within 90 days of the Effective Date, via the Documented Claim Form available on the Settlement Website and be supported by a solemn declaration and signature. A valid Documented Claim makes the Claimant automatically eligible to receive a share of the amount available for Undocumented Claims as well. However, in order to receive a reimbursement for out-of-pocket expenses or losses, supporting documentation of the expense or loss claimed must be provided and approved by the Settlement Administrator.
• Supporting documentation is required (statements, receipts, invoices, or other documented proof). For clarity, the email(s) or letter(s) from CIRO notifying you of the Cyber Incident do not constitute acceptable supporting documentation.
• Expenses must have been incurred between August 18, 2025, and November 10, 2026. Future or expected expenses cannot be claimed.
• If the total value of all Approved Documented Claims exceeds the amount available for Documented Claims, payments will be reduced proportionally on a pro rata basis.
• The Settlement Administrator’s determination of claims (whether approved or denied, in whole or in part) and amounts will be final and without appeal.

c) Undocumented Claims

Third, a minimum of two million two hundred and forty thousand five hundred Canadian dollars (CAD $2,240,500) is reserved for Undocumented Claims requiring no supporting documentation (plus any unused amounts from Documented Claims amount above). The amount available for Undocumented Claims will be divided equally between all Class Members who submit a valid and timely Claim to the Settlement Administrator.

• To be valid, Undocumented Claims must be submitted by a Class Member within 90 days of the Effective Date, via the Undocumented Claim Form available on the Settlement Website and be supported by a solemn declaration and signature.
• Class Members who have submitted a valid Documented Claim as described above, whether or not it was approved, in whole or in part, will also receive a share of the Undocumented Claims amount, and in addition to their Approved Documented Claim amount, if any.
• The amount of fixed indemnity for Undocumented Claims will be calculated by the Settlement Administrator at the end of the Claims process by dividing the remaining Settlement Amount.
• Once calculated, if the amount of the fixed monetary payment is less than CAD $3.00, no individual payments will be issued to Class Members for Undocumented Claims. The remaining Settlement Amount will instead be donated to charity Prosper Canada, after payment of the Fonds d’aide aux actions collectives (“FAAC”) levy, as applicable. The FAAC is legally entitled to a percentage of the Québec portion of any remaining balance from the Settlement Amount, according to the Regulation respecting the percentage withheld by the Fonds d’aide aux actions collectives.

The Claim Forms for Documented and Undocumented Claims available on the Settlement Website contain all the instructions and information that must be provided to the Settlement Administrator to submit a Documented or Undocumented Claim.

Fees and costs

The Settlement Agreement includes the payment of administration and notice costs (up to a maximum of CAD $2,300,000), and the payment of Class Counsel fees of one million three hundred and fifty thousand Canadian dollars (CAD $1,350,000) plus taxes and disbursements not exceeding ten thousand Canadian dollars (CAD $10,000) including taxes. These amounts will be paid from the Settlement Amount.

The Settlement must be approved by the Court before it can be implemented. The Claim Forms and the instructions for requesting Additional Credit Monitoring are not yet available; they will be posted on this website if the Settlement is approved and becomes effective.