Hackers may have accessed bank info

BMO, CIBC threatened with claims of stolen data from up to 90,000 clients

Two of Canada’s biggest banks warned Monday that “fraudsters” may have accessed certain personal and financial information of up to 90,000 customers.

The Bank of Montreal said hackers contacted the bank on Sunday claiming to be in possession of the personal information of fewer than 50,000 customers and threatened to make it public.

“We became aware of unverified claims that customer personal and financial data may have been accessed by a fraudster,” said spokesperson Paul Gammal in an emailed statement Monday.

“A threat was made. Our practice is not to make payments to fraudsters. We are focused on protecting and helping our customers.”

The bank said it believes the attack originated outside Canada, but did not elaborate on the type of data they accessed.

Gammal said the bank is conducting a thorough investigation and is working with the relevant authorities.

The disclosure followed a warning from CIBC’s direct banking brand Simplii Financial that also said “fraudsters” may have electronically accessed certain personal and account information for approximately 40,000 Simplii Financial clients.

Simplii said Monday it learned of the potential issue on Sunday and that it has implemented additional online security measures such as enhanced online fraud monitoring, and also that it is working with the relevant authorities.

Gammal said the potential breach at BMO appears to be related to the CIBC issue. Royal Bank, Scotiabank and TorontoDominion Bank said they have no indication that they were affected.

Minister of Finance Bill Morneau has spoken to the chief executives of both of the affected institutions, ministry spokesperson Jocelyn Sweet said.

“The situation is being investigated by the institutions in collaboration with law enforcement,” she said in an emailed statement.

The Office of the Privacy Commissioner said Monday that both financial institutions have notified it about the issue.