Wealthsimple, a major Canadian online investment manager, disclosed a data breach after attackers accessed personal data from an undisclosed number of customers. The company detected the incident on Aug. 30, according to breach notifications and an official statement.
Founded in 2014 and headquartered in Toronto, Wealthsimple manages more than CAD$84.5 billion in assets and serves over 3 million Canadians. Its Android app has more than 1 million downloads on the Google Play Store, while its iOS app has more than 126,000 ratings on the Apple App Store.
In an official breach notification, Wealthsimple said the attackers did not steal funds and did not compromise passwords, and that customer accounts remained secure. “We learned that a specific software package that was written by a trusted third party had been compromised. This resulted in personal data belonging to less than 1% of our clients being accessed without authorization for a brief period,” Wealthsimple said.
The company said the data accessed included personal information such as contact details, government IDs provided during sign-up, financial details including account numbers, IP addresses, Social Insurance Numbers, and dates of birth. Affected customers have been notified by email, and Wealthsimple is providing two years of complimentary credit monitoring, dark-web monitoring, identity theft protection, and insurance.
Officials noted that the breach appears linked to a broader supply-chain attack involving a third-party software package. Wealthsimple has acknowledged the existence of a Salesloft instance on its own subdomain which appears to be inactive, and industry observers have connected the incident to the ongoing wave of Salesforce-related breaches associated with the ShinyHunters group.
Wealthsimple urged customers to secure their accounts with two-factor authentication (2FA) using an authenticator app, avoid reusing passwords, and stay vigilant for phishing attempts impersonating Wealthsimple. The firm also noted it is actively investigating and cooperating with authorities as it monitors for further developments.