Two Canadian banks warned customers Monday that they have been the targets of a recent hack attempt, and in one case the personal information of as many as 40,000 customers may have been stolen.
CIBC-owned Simplii Financial was the first to warn on Monday morning that fraudsters had accessed the personal and account information of more than 40,000 of the bank's customers.
The bank said it received a tip over the weekend that fraudsters had obtained the data, and after a preliminary investigation decided to go public on Monday.
"We're taking this claim seriously and have taken action to further enhance our monitoring and security procedures," the bank's senior vice-president Michael Martin said in a statement.
Then later Monday morning, Bank of Montreal revealed that it, too, had received a tip that hackers had stolen data on the bank's customer base.
In BMO's case at least, the tipsters were the hackers themselves.
"We took steps immediately when the incident occurred and we are confident that exposures identified related to customer data have been closed off," BMO said.
"We have notified and are working with relevant authorities as we continue to assess the situation. We are proactively contacting those customers that may have been impacted and we will support and stand by them," BMO said.
When asked whether the hackers themselves were the ones who tipped off the bank over the weekend, Simplii did not expand on their initial statement.
BMO's statement Monday implies that some data was in fact stolen, although the bank declined to say how many customers may have been affected. The bank said the hack appears to have originated outside Canada.
It's unclear where Simplii came up with the 40,000 figure, as that number represents a tiny fraction of the roughly 2 million customers the bank inherited when CIBC took over Simplii — at the time known as President's Choice Financial — from Loblaws last fall.
Simplii says its investigation is continuing, and it will continue to notify affected clients "through all channels" if it is determined they have been compromised.
"We feel that it is important to inform clients so that they can also take additional steps to safeguard their information," Martin said.
"If a client is a victim of fraud because of this issue, we will return 100 per cent of the money lost from the affected bank account," the release said.
There is no indication that other CIBC customers are affected, Simplii said.