Canada’s investment industry watchdog is proposing an $8.3 million settlement over a breach of sensitive investor records, but only $3.74 million is initially earmarked for cash claims, according to detailed terms made public Tuesday.
The remaining money is divided between $700,000 for additional credit monitoring and roughly $3.86 million for legal fees, taxes, administration, and notices. The allocation means just 45% of the proposed settlement is initially reserved for direct monetary compensation.
The Canadian Investment Regulatory Organization, which oversees investment and mutual fund dealers, faces a national class action arising from a 2025 cyberattack. It denies the allegations and any liability.
Sponsored · Selkirk Copper Mines
The settlement notice issued by class counsel Lex Group lists at least $1.497 million for documented losses and at least $2.2405 million for claims that do not require receipts. Unused funds in specified categories can be reallocated under the agreement, so these allocations are not fixed final payout totals.
The proposal allows up to $2.3 million for administration and notifications. Lawyers would receive $1.35 million plus taxes, alongside up to $10,000 in disbursements.
For scale, dividing the $8.3 million settlement by the approximately 750,000 investors whom CIRO identified as affected produces $11.07 per investor. Dividing the initial cash allocation by that figure produces $4.98.
A claimant with documented expenses could seek up to $10,000, subject to verification and available funds. Qualifying expenses must have been incurred between August 18, 2025, and November 10, 2026. If approved claims exceed the relevant pool, payments would be reduced proportionally.
The undocumented-claims pool will be split among people who submit valid claims. If the calculated individual payment falls below $3, the agreement provides for no individual payments from that category. Remaining money would instead go to Prosper Canada, subject to any applicable Quebec class-action levy.
The breach began around August 6, 2025, and CIRO says it detected a cybersecurity incident on August 11. Its January disclosure said exposed records potentially included social insurance numbers, annual incomes, government identification numbers, and investment account statements.
CIRO has said it found no evidence of misuse.
The parties reached their agreement on September 11, while the $8.3 million figure and allocations were publicly announced November 10. The Quebec Superior Court authorized the action for settlement purposes only on September 22.
Affected class members have until December 15 to opt out or submit objections. A hearing is scheduled for January 14, 2027. If approved, claimants will have to apply within 90 days of the settlement’s effective date.
