BMO is warning that “fraudsters” from outside of the country may have accessed certain personal and financial information of some of its customers. THE CANADIAN PRESS/Nathan Denette

BMO is warning that “fraudsters” from outside of the country may have accessed certain personal and financial information of some of its customers. THE CANADIAN PRESS/Nathan Denette

Hackers say they have client data from BMO and CIBC

The banks say they are conducting a thorough investigation

Two of Canada’s biggest banks warned Monday that up to 90,000 customers may have had certain personal and financial information compromised after “fraudsters” contacted both banks claiming to have obtained sensitive data.

The Bank of Montreal said hackers contacted the bank on Sunday claiming to be in possession of the personal information of fewer than 50,000 customers, however it did not elaborate on the type of data they accessed. The bank believes the attack originated from outside of Canada.

“We are conducting a thorough investigation,” spokesman Paul Gammal said in an emailed statement on Monday.

“We became aware of unverified claims that customer personal and financial data may have been accessed by a fraudster and a threat was made to make it public. We are working with the relevant authorities,” he said. BMO did not say whether the attacker asked for money in an extortion attempt as they have done in other high-profile breaches.

Gammal said the two hacks appear to be related. Royal Bank, Scotiabank and Toronto-Dominion Bank said they have no indication they have been affected.

CIBC’s direct banking brand Simplii Financial also warned Monday that “fraudsters” may have electronically accessed certain personal and account information for approximately 40,000 clients. Simplii said it received a claim on Sunday that their clients’ data may have been accessed.

“We are investigating to determine the validity of the claims and the type of the information that may have been accessed,” said CIBC spokesman Tom Wallis in an emailed statement.

Wallis said he could not comment on whether the hackers had attempted to extort CIBC “except to say that it is our practice not to pay ransom demands as it encourage further fraudulent activity.”

Simplii has since implemented additional online security measures such as enhanced online fraud monitoring. The bank said there is no indication that clients who bank through CIBC have been affected.

Both BMO and CIBC said they will contact clients, and recommended that customers monitor their accounts and notify their financial institution about any suspicious activity.

Minister of Finance Bill Morneau has spoken to the chief executives of the affected institutions, according to ministry spokeswoman Jocelyn Sweet.

“We are monitoring the situation closely with the Office of the Superintendent of Financial Institutions,” she said in an emailed statement. “The situation is being investigated by the institutions in collaboration with law enforcement.”

The Office of the Privacy Commissioner said Monday that it has been notified by both financial institutions, but that it is not launching a formal investigation at this point.

“We are working with the organizations to better understand what occurred and what they are doing to mitigate the situation,” said spokeswoman Valerie Lawton in an email.

Financial institutions are attacked more than any other type of business or organization in the world, largely because the “bad guys are looking to make financial gain,” said David Masson, country manager for Canada with cybersecurity firm Darktrace.

It’s common for the target of a cyberattack to learn of the incident from someone outside of their organization, such as a customer, a third-party supplier, law enforcement officials or an intelligence service, he added.

“Or, and it’s not unusual, the bad guys run up and say, ‘Hey, we’ve got your stuff, give us your money or we’re going to disclose it’,” said Masson.

Consumers need to do their own due diligence after such an incident to limit any potential losses, said David Fewer, the director of the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa.

Consumers “should be concerned,” given the kind of details the banks have about their clients, he said.

“This is important financial information, and a lot of damage can occur… Even if it’s just account information, and not the more sensitive identity document information, for example, that’s still significant.”

Simplii said Monday that clients who are victims of fraud because of the issue will receive 100 per cent of the money lost from the affected bank account.

CIBC launched Simplii in November and absorbed the accounts of some two million President’s Choice Financial account holders. CIBC had provided the back-end banking services for PC Financial for nearly 20 years, but last August the bank struck a deal with PC’s parent company Loblaw to go their separate ways.

The potential data breaches reported by Simplii and BMO on Monday are the latest cybersecurity incidents involving Canadians.

Last fall, credit reporting service Equifax notified the public that hackers accessed or stole the personal data of 145.5 million U.S. customers and 19,000 Canadians. In January, Bell Canada warned some of its customers that their information, such as names and email addresses, had been illegally accessed in a data breach.

In November, ride-sharing company Uber said hackers stole names, email addresses and mobile phone numbers of 815,000 Canadian riders and drivers as part of a worldwide data breach.

New federal data breach regulations that would require mandatory reporting of security breaches are set to take effect on Nov. 1.

The regulations require organizations to determine if a data breach poses a risk to any individual whose information was involved and then to notify the federal privacy commissioner and affected individuals “as soon as feasible”. Previously, companies which had been hacked had been alerting the public on their own timeline.

The Canadian Press

Like us on Facebook and follow us on Twitter.

Just Posted

FILE – Perry Bellegarde, National Chief of the Assembly of First Nations, takes part in an event on Parliament Hill in Ottawa on Tuesday, July 7, 2020. THE CANADIAN PRESS/Sean Kilpatrick
Indigenous Peoples Day must be a ‘call to action’, says Assembly of First Nations chief

Discovery of children at Kamloops residential school site must lead to change, Perry Bellegarde says

This undated file photo provided by Ernie Carswell & Partners shows the home featured in the opening and closing scenes of The Brady Bunch in Los Angeles. Do you know the occupation of Mike Brady, the father in this show about a blended family? (Anthony Barcelo/Ernie Carswell & Partners via AP, File)
QUIZ: A celebration of dad on Father’s Day

How much do you know about famous fathers?

North Westside residents can dispose of their unwanted bulky items between June 30 and July 14, 2021. (File photo)
North Westside residents can soon get rid of unwanted bulky items

Large household items can be disposed of at North Westside Transfer Station June 30 to July 14

Starting in 2022, the Columbia Shuswap Regional District is extending dog control to the entire Electoral Area D area. (Stock photo)
Dog control bylaw passes in Shuswap area despite ‘threatening’ emails

CSRD board extending full dog control to Electoral Area D; director calls for respectful discussion

The new Civic Memorial Park will incorporate pieces of the 80-year-old arena it replaces. (Artists rendering)
Pieces of Civic Arena reclaimed for new Vernon park

City centre space to incorporate wood from the historic arena

Marco Mendicino, Minister of Immigration, Refugees and Citizenship during a press conference in Ottawa on Thursday, May 13, 2021. THE CANADIAN PRESS/Sean Kilpatrick
Canada to welcome 45,000 refugees this year, says immigration minister

Canada plans to increase persons admitted from 23,500 to 45,000 and expedite permanent residency applications

Tokyo 2020 President Seiko Hashimoto and IOC President Thomas Bach, on a screen, speak during a five=party online meeting at Harumi Island Triton Square Tower Y in Tokyo Monday, June 21, 2021. The Tokyo Olympics will allow some local fans to attend when the games open in just over a month, Tokyo organizing committee officials and the IOC said on Monday. (Rodrigo Reyes Marin/Pool Photo via AP)
Tokyo Olympics to allow Japanese fans only, with strict limits

Organizers set a limit of 50% capacity — up to a maximum of 10,000 fans

The border crossing into the United States is seen during the COVID-19 pandemic in Lacolle, Que. on February 12, 2021. THE CANADIAN PRESS/Paul Chiasson
Border quarantine to soon lift for fully vaccinated Canadians

Eligible travellers must still take multiple COVID-19 tests

The Pierre family, an Indigenous family, once lived in what is now downtown Summerland. Today, Pierre Drive is named in honour of the family. (Photo courtesy of the Summerland Museum)
Pierre family played role in Summerland’s history

Downtown Summerland was once Penticton Indian Reserve #3

A portion of the George Road wildfire burns near Lytton, B.C. in this Friday, June 18, 2021 handout photo. THE CANADIAN PRESS/HO, BC Wildfire Service *MANDATORY CREDIT*
Blaze near Lytton spread across steep terrain, says BC Wildfire Service

Fire began Wednesday and is suspected to be human-caused, but remains under investigation

Jaimee Peters photo of a Willow Midwives helping with a birth. Willow closed its doors March 31 because of a shortage of midwives. (Contributed)
South Okanagan’s only midwifery to re-open this summer

Willow Community Midwives was forced to close because of a shortage of midwives

Blair Lebsack, owner of RGE RD restaurant, poses for a portrait in the dining room, in Edmonton, Friday, June 18, 2021. Canadian restaurants are having to find ways to deal with the rising cost of food. THE CANADIAN PRESS/Jason Franson
Canadian restaurateurs grapple with rising food costs, menu prices expected to rise

Restaurants are a low margin industry, so there’s not a lot of room to work in additional costs

Gord with a mom and her young son outside Pathways which was defunded on May 31. (Facebook)
Gord Portman with a mom and her child outside of Pathways. The sign says it all about the difference Pathways has made in people’s lives. They were defunded by Interior Health on May 31.
Penticton man takes the plunge for the recovery house that helped save his life

Gord Portman said Discovery House and Pathways have been everything in his 1 year sobriety

Most Read