Skip to main content
The Globe and Mail
Support Quality Journalism.
The Globe and Mail
First Access to Latest
Investment News
Collection of curated
e-books and guides
Inform your decisions via
Globe Investor Tools
per week
for first 24 weeks

Enjoy unlimited digital access
Enjoy Unlimited Digital Access
Get full access to
Just $1.99per week for the first 24weeks
Just $1.99per week for the first 24weeks
var select={root:".js-sub-pencil",control:".js-sub-pencil-control",open:"o-sub-pencil--open",closed:"o-sub-pencil--closed"},dom={},allowExpand=!0;function pencilInit(o){var e=arguments.length>1&&void 0!==arguments[1]&&arguments[1];select.root=o,dom.root=document.querySelector(select.root),dom.root&&(dom.control=document.querySelector(select.control),dom.control.addEventListener("click",onToggleClicked),setPanelState(e),window.addEventListener("scroll",onWindowScroll),dom.root.removeAttribute("hidden"))}function isPanelOpen(){return dom.root.classList.contains(}function setPanelState(o){dom.root.classList[o?"add":"remove"](,dom.root.classList[o?"remove":"add"](select.closed),dom.control.setAttribute("aria-expanded",o)}function onToggleClicked(){var l=!isPanelOpen();setPanelState(l)}function onWindowScroll(){window.requestAnimationFrame(function() {var l=isPanelOpen(),n=0===(document.body.scrollTop||document.documentElement.scrollTop);n||l||!allowExpand?n&&l&&(allowExpand=!0,setPanelState(!1)):(allowExpand=!1,setPanelState(!0))});}pencilInit(".js-sub-pencil",!1); // via darwin-bg var slideIndex = 0; carousel(); function carousel() { var i; var x = document.getElementsByClassName("subs_valueprop"); for (i = 0; i < x.length; i++) { x[i].style.display = "none"; } slideIndex++; if (slideIndex> x.length) { slideIndex = 1; } x[slideIndex - 1].style.display = "block"; setTimeout(carousel, 2500); } //

Bank of Montreal and Simplii Financial are grappling with the fallout from apparent data breaches that may have exposed sensitive personal and financial information belonging to tens of thousands of customers.

A day after both banks revealed that as many as 90,000 total customers may be affected, both banks were still working to contact customers whose data may have been stolen, freeze accounts at risk of further fraud and reimburse fraudulent transactions.

Alleged “fraudsters” contacted BMO and Simplii on Sunday, claiming to have accessed the data, and “a threat was made,” according to a BMO spokesperson. The banks revealed the breaches on Monday morning and have begun reaching out to affected clients. But many customers are still confused about how to access their banking, waiting for lost funds to be returned, and left wondering whether their personal data leave them vulnerable to further fraud.

Story continues below advertisement

“We are proactively contacting customers and taking all available means to protect their accounts, including blocking online and mobile access to accounts that may have been impacted, personally calling each impacted customer, as well as offering them free credit monitoring,” BMO spokesman Paul Gammal said in an e-mail.

BMO, which is Canada’s fourth-largest bank, said customers whose online accounts have been blocked by the bank can visit a branch or use telephone banking in the meantime, and that most debit cards are still working. For an online bank such as Simplii, the solution isn’t so simple, but customers who can’t access their accounts online can still use ATMs or access cash from some merchants.

On Saturday night, Will Lochner, a Simplii customer and student from Ayr, Ont., received a notification that someone he didn’t recognize had accepted a $485 e-transfer that he didn’t send. He contacted Simplii, changed his password and was issued a new bank card. His complaint is being investigated, but he has yet to receive the new card. Fortunately, he works a farm job that pays in cash, and “I’m kind of just going off the cash right now,” he said. “It’s been a bit confusing, to be honest.”

Both BMO and Simplii have promised to reimburse customers for funds lost through unauthorized transactions arising from the data breaches. “Customers will not lose money from this,” Mr. Gammal said.

Yet some clients have waited days and still don’t know when they will be reimbursed for transactions that, in some cases, total thousands of dollars.

Matthew Smith has banked with Simplii, which is owned by Canadian Imperial Bank of Commerce and was formerly part of President’s Choice Financial, for more than a decade. But last Thursday, he was unable to log in to his accounts and the safety questions to recover his password had been changed. When he reached Simplii, he was told his account was flagged for suspicious activity: Two e-mail money transfers, each for $1,500, had been sent to recipients he’d never heard of.

Mr. Smith was told on Thursday that he would be reimbursed in one to two business days, but the funds haven’t arrived. “I’m quite unhappy about the whole situation,” he said. “We’re trusting these banks with so much of our information and I don’t feel the way they’ve handled this whole thing has been very good.”

Story continues below advertisement

Mr. Smith’s experience is typical of an apparent pattern in the instances of fraud reported by customers who believe their data have been exposed: The user is unable to log in, the account’s security questions have been changed and unauthorized e-transfers have been sent without their knowledge.

Simplii spokesperson Olga Petrycki said in a statement that the bank is offering support to those who’ve been affected, and has a “dedicated team” working to remedy clients’ issues.

“Simplii is extending free credit monitoring to impacted clients and we are committed to returning 100% of any money lost from affected accounts as a result of this issue. We are also replacing affected clients’ bank cards and taking additional steps to monitor and protect our clients,” she said.

The alleged hackers’ apparent ability to take control of numerous accounts and move money electronically speaks to the sensitivity of the data that have allegedly been stolen.

“There are categories of information which are more valuable,” said Imran Ahmad, a lawyer who leads the cybersecurity practice at Miller Thomson LLP. “ If you steal somebody’s credit card information, that’s typically a very short shelf life and relatively easy to fix. If you steal somebody’s full identity by getting access to their [social insurance number], their banking details and can build a virtual profile, that identity theft can take a very long time … to correct or to fix.”

On Monday, a Facebook post from an account claiming to represent the alleged hackers included a link to a website that seemed to contain several hundred people’s private banking information. The entries included names, account numbers, dates of birth and social insurance numbers, among other data. The page was removed later that day by the site’s administrator.

Your Globe

Build your personal news feed

  1. Follow topics and authors relevant to your reading interests.
  2. Check your Following feed daily, and never miss an article. Access your Following feed from your account menu at the top right corner of every page.

Follow the author of this article:

View more suggestions in Following Read more about following topics and authors
Report an error Editorial code of conduct
Tickers mentioned in this story
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to If you want to write a letter to the editor, please forward to

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

If you do not see your comment posted immediately, it is being reviewed by the moderation team and may appear shortly, generally within an hour.

We aim to have all comments reviewed in a timely manner.

Comments that violate our community guidelines will not be posted.

UPDATED: Read our community guidelines here

Discussion loading ...

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies