Overview

• Unauthorized access was detected on August 30 and contained within hours, with public disclosure and customer notifications sent on September 5 at 10:30 a.m. ET.
• Personal data for less than 1% of roughly 3 million clients was accessed, including contact details, government IDs, account numbers, IP addresses, Social Insurance Numbers, and dates of birth.
• Wealthsimple says passwords were not exposed and no customer funds were accessed, with all accounts remaining secure.
• Affected clients are receiving two years of credit monitoring, dark‑web monitoring, identity theft protection, and insurance, and privacy and financial regulators have been notified.
• Wealthsimple cites a compromised third‑party software package as the cause, while BleepingComputer reports the incident may be linked to a broader Salesloft supply‑chain campaign associated with ShinyHunters.