Karsten Wenzlaff, Advisor
August 26th, 2025
Cybersecurity | January 14, 2026

Image: Freepik/macrovector
On January 14, 2026, the Canadian Investment Regulatory Organization confirmed that approximately 750,000 Canadian investors were impacted by the cybersecurity incident first detected on August 11, 2025, as detailed in its update on unauthorized access to some Canadian investors’ data. CIRO said the confirmation follows the completion of more than 9,000 hours of forensic examination to determine the full scope of the incident.
CIRO first disclosed the cyber incident publicly in August 2025, with early findings focused on registration information connected to member firms and registered individuals. NCFA covered those initial disclosures, CIRO cyber breach puts spotlight on regulatory security, when they were made public in September 2025. Now after
CIRO stated that the breach resulted from a phishing attack and that investor information copied from its systems may have included dates of birth, phone numbers, annual income, Social Insurance Numbers, government issued identification numbers, investment account numbers, and investment account statements.
CIRO confirmed that it doesn't collect account login credentials such as passwords, security questions, or PINs, so at least that information wasn't exposed.
According to CIRO, the investor information was collected in the normal course of its investigative, compliance assessment, and market regulation work carried out under its investor protection mandate.
On August 11, 2025, CIRO detected a cybersecurity incident and shut down certain systems as a precaution while beginning an investigation.
On August 18, 2025, CIRO publicly disclosed the incident through its announcement on detecting a cybersecurity threat and confirmed that critical regulatory functions continued to operate.
On September 2025, CIRO confirmed that registration information for member firms and registered individuals had been affected and began notifying registrants directly, as outlined in its updates on CIRO cybersecurity incident updates.
On January 14, 2026, CIRO confirmed that approximately 750,000 investors were impacted and began issuing notification letters to affected investors by email or regular mail. CIRO stated that the January disclosure reflects the final findings of the forensic review and confirms the full extent of the data involved.
Notification letters to impacted investors are being sent by CIRO starting January 14, 2026, and are being delivered by email or regular mail, as explained on its page covering information for investors affected by the cybersecurity incident.
Affected investors are being offered two years of credit monitoring and identity theft protection through both major Canadian credit bureaus. CIRO said there is currently no evidence that the compromised information has been misused and that it continues to monitor for malicious activity, including the dark web.
This latest update materially expands the known scope of the CIRO cyber incident. Earlier disclosures focused on registrant data and regulatory systems. Hundreds of thousands of investors were affected, a significantly larger scale of exposure.
CIRO said that it notified law enforcement and relevant privacy authorities and retained external cybersecurity and forensic specialists to support its investigation. The regulator also acknowledged that a proposed class action has been filed in Quebec Superior Court in relation to the breach, adding a legal angle to the story that will no doubt continue to unfold together with remediation efforts. One might ask why were the disclosures phased, but the cyber incident seems complex given the completion of a 9,000 hour forensic review.
For Canada’s financial system, the CIRO's data breach reinforces that cybersecurity risk extends beyond financial institutions themselves and into the infrastructure that supports regulation and investor protection. How regulators secure sensitive data, communicate evolving findings, and strengthen controls going forward will be important for maintaining confidence in market oversight.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
AI Regulation | Jan 14, 2026

Image: Freepik
In the first days of January 2026, Elon Musk's AI chatbot Grok (developed by xAI and integrated into X) generated sexual images of real people, including images apparently involving minors, after internal safeguards failed. The issue became public immediately after the New Year and has gone viral since. What began as a platform failure quickly expanded into regulatory, legal, and civil society responses across multiple jurisdictions.
Malaysia and Indonesia are the only countries that have confirmed national blocks of Grok access, citing the creation of non-consensual sexualised imagery and public safety risks.
European Union officials also warned that failure to address the issue could lead to enforcement under existing digital safety rules. No EU-wide restriction has been imposed.
Public pressure has also played a role. International NGO Oxfam confirmed it's examining reports involving AI generated sexualised images created by altering real photographs, framing the concern around harm, consent, and exploitation.
Individuals whose likenesses were used in non-consensual AI generated sexual imagery have spoken out publicly in the United States, describing personal harm and exploring legal remedies, as reflected in accounts from people targeted by AI sexual images. Some unions and professional groups have also reduced or paused activity on X following the controversy.
In the United Kingdom, Ofcom launched a formal investigation into X after what it described as “deeply concerning reports” that Grok was being used to create and share sexualized images, including children.
Ofcom said it will assess whether X failed to remove illegal content quickly once aware of it, whether it took appropriate steps to prevent UK users from seeing such material, and whether it deployed highly effective age assurance measures to stop children from accessing pornographic images.
If Ofcom finds X has breached UK law, it can impose a fine of up to 10% of worldwide revenue or £18 million (whichever is greater), and can seek a court order requiring internet service providers to block access to X in the UK.
UK ministers publicly backed the investigation, urging Ofcom to complete it swiftly and stating that victims would not accept delay.
Elon Musk responded publicly by criticising government actions, saying the UK government was looking for “any excuse for censorship” after questions were raised about why other AI platforms were not being examined. Separately, Musk said he was unaware Grok had generated explicit images involving minors and stated such uses violate platform rules.
The United States has not blocked Grok, but lawmakers have focused on liability. The US Senate unanimously passed legislation allowing victims of non-consensual sexually explicit AI generated images to pursue civil action, including damages and court orders.
Canada has also avoided a ban. Ottawa's AI Minister Evan Solomon responsible for artificial intelligence stated the government will not ban Grok or X at this stage, while acknowledging that Canadian law doesn’t clearly address AI generated non-consensual sexual imagery, and that laws needed updating to address deepfakes.
To be sure, AI governance tightens once harm involves identifiable individuals as in this case. Across jurisdictions, responses are focusing on consent, child protection, and platform accountability rather than abstract debates about speech. For fintechs and other regulated firms deploying generative AI, scrutiny is on improving governance, safeguards, and enforcement readiness.
From NCFA's perspective, AI systems should operate within clear legal and ethical boundaries that protect individuals, maintain public trust, and still allow responsible innovation to move forward. As of now, verified developments include two confirmed national blocks, active regulatory investigations, quantified enforcement powers, and new US civil liability legislation. Further responses remain under review.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Payments | Jan 12, 2026

Image: Freepik/stockking
On January 8, 2026, UK consumer watchdog Which? published an eye-opening article, "Why cancelling your card might not stop fraud"explaining why cancelling a compromised card doesn't always stop fraud. The article covers a real world case showing how replacement card details can continue moving through global payment systems, allowing fraudulent charges to resume even after a bank issues a new card. What stands out is that the issue has little to do with careless consumers or missed fraud alerts. It sits deeper, inside how modern card payment infrastructure is built to keep payments running.
Most global card networks run automatic card updater services. These systems exist to make sure legitimate payments don’t suddenly fail when a card expires or gets replaced.
If a cardholder has previously saved their card with a merchant, the card network can automatically send the replacement card details to that merchant. The cardholder doesn’t need to approve anything and doesn’t need to take any action. It just happens.
These services operate across Visa, Mastercard, and American Express. They help subscriptions and recurring payments keep working without interruption. The problem is that the same process can also allow fraud to continue if a criminal has already saved stolen card details inside an account they control. So even when the bank issues a replacement card, if the network automatically updates that account with the new card details, then the fraudulent charges/payments can continue (and likely will leaving consumers bewildered and in the lurch).
In practice, when an automatic card updater service refreshes stored card details, the update usually happens quietly between the card network, the issuing bank, and the merchant (it all runs in the background).
Cardholders are typically told that a replacement card has been issued. They aren’t clearly told that the new card number may be sent automatically to merchants where the old card was saved, including after fraud. They also aren’t told which merchants receive those updated details.
Some merchants may show a generic message such as “your payment details were updated,” but this varies by platform and is easy to miss. There isn't a standard alert explaining that replacement card credentials were transmitted automatically.
Many consumers never realize that automatic updates exist at all. And in most cases, they don’t know the updates can continue after fraud unless someone stops them. Then it stands to reason that they also likely don’t know they can ask their bank to turn them off. Automation keeps running by default, while awareness and consent lag behind.
The Which? article confirms that issuing banks can disable updater services or perform what fraud teams often describe as a full wipe. This stops replacement card details from being shared with any online accounts or digital wallets.
The catch is that this step isn’t automatic. In most cases, the customer has to know the option exists and ask for it. Once a consumer later adds their card back to trusted merchants, those accounts may again become eligible for automatic updates.
That means that the outcomes depend more on awareness than on risk.
Fraud isn’t a routine card replacement; it’s a security failure, and the system doesn’t always treat it that way. Automatic updater services make sense when a card expires or gets damaged, but when fraud has already occurred, letting replacement credentials continue to move silently through the system creates avoidable risk. Requiring express consumer consent after fraud and making full wipe policies the default response would reduce repeat incidents and avoid putting the burden on consumers to navigate payment systems they can’t see.
This situation is a good example of how invisible infrastructure decisions can cause real harm when transparency and control fall behind automation. Payments innovation can’t rely on convenience alone. Trust in digital finance depends on how clearly systems explain what’s happening and how decisively they contain risk once something goes wrong.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |