A sophisticated phishing attack hit the Canadian Investment Regulatory Organization (CIRO), the national self-regulatory body overseeing investment dealers, mutual fund dealers, and trading activity in Canada. The attack occured in August 2025. Following a sophisticated phishing attack, approximately 750,000 Canadian investors had their sensitive personal and financial information compromised. The initial access was achieved via phishing, mapped to MITRE ATT&CK technique T1566: Phishing. The sophistication of the attack suggests the possible use of spearphishing attachments (T1566.001) or spearphishing links (T1566.002).