BMO data breach (2018): the online-banking flaw, the ransom demand, and what followed
BMO (Bank of Montreal, including BMO Capital Markets and BMO Bank N.A. in the US) had one major confirmed breach in the decade: the 2017-2018 compromise of its Canadian online banking, disclosed alongside CIBC’s Simplii Financial in May 2018. This page is the sourced record from November 2016 to November 2026.
Short answer
Was BMO hacked?
Yes. Attackers exploited a “session corruption vulnerability” in BMO’s in-house online banking application to reach other customers’ accounts using only card numbers, according to the Privacy Commissioner of Canada’s 2021 findings. BMO determined that 113,154 customers were affected across attacks between June 2017 and January 2018. It learned the scope only when an extortionist emailed in May 2018 demanding a $1 million ransom; BMO refused and the attacker posted 3,190 customers’ records.
The Commissioner found BMO lacked safeguards appropriate to the sensitivity of the data, in breach of PIPEDA, and noted BMO’s later improvements. An Ontario court approved a $21.2 million class settlement in April 2021. In the US, a 2023 BMO Bank N.A. notice tied to the vendor Pension Benefit Information appears in Maine’s breach list (seen via search).
Timeline at a glance
Aug 2023BMO Bank N.A. notice via vendor PBI: names and SSNs (Maine AG entry, via search). (Maine AG (via search))Reported
21 Apr 2021Ontario court approves a $21.2M settlement for 113,000+ BMO clients. (Investment Executive)Confirmed
Mar 2021Privacy Commissioner finds BMO’s safeguards inadequate under PIPEDA. (OPC Canada)Confirmed
28 May 2018BMO and Simplii disclose fraudsters’ claims; BMO says about 50,000 clients. (Bank Info Security)Confirmed
Jun 2017 – Jan 2018Attacks through an app flaw compromise 113,154 BMO customers. (OPC Canada)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
BMO incident timeline, in detail
Confirmed = acknowledged by BMO, a regulator filing or a court. Reported = credible reporting BMO has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Aug 2023ReportedThird-party / file transfer
BMO Bank N.A. customer data in a vendor incident (via search)
What happened. Search results show a Maine AG entry for BMO Bank, N.A. with the breach discovered on 9 August 2023, consumer notices on 31 August 2023, and letters sent through Pension Benefit Information (PBI). A law-firm post says PBI notified BMO customers affected by the 2023 MOVEit Transfer attack. We could not open the Maine entry and did not find a BMO statement on it.
Impact. Names with Social Security numbers, per the search snippet of the Maine entry. No count was confirmed; a figure of 56,000 on a law-firm site is unverified and not used here.
Mar – Jun 2021ConfirmedRegulatory finding / settlement
Privacy Commissioner finding and class settlements
What happened. The Office of the Privacy Commissioner of Canada (PIPEDA Findings #2021-003) found complaints against BMO “well-founded and resolved”: BMO did not have safeguards commensurate with the sensitivity of the information, contrary to Principle 4.7. It called the “development and deployment of a public-facing banking application with a critical vulnerability” the core safeguard issue. On 21 April 2021 the Ontario Superior Court approved BMO’s settlement.
Impact. The settlement was $21.2 million for more than 113,000 clients; BMO had already paid $6.85 million for fraudulent transfers, per Investment Executive. Search results show a separate Quebec settlement approved in June 2021 (not opened). The OPC finding carried no fine.
What happened. Per the OPC, a session-corruption flaw in BMO’s online banking let a logged-in user reach other accounts using card numbers. Attackers used bots to cycle card numbers; BMO first read it as a brute-force attack. The “Apply for Product” page left an unencrypted file of customer data in the session cache, which the attackers collected. BMO patched in January 2018 and fixed permanently in June 2018. On 28 May 2018 BMO and CIBC’s Simplii said fraudsters claimed to hold customer data; BMO said about 50,000 of its 8 million Canadian clients may be involved and that the attackers were outside Canada.
Impact. The OPC says 113,154 customers were affected: 36,755 in attacks from June to November 2017 and 76,399 in December 2017; 62,945 records included Social Insurance Numbers and dates of birth. After BMO refused the $1 million ransom, 3,190 customers’ data was posted publicly.
How many BMO customers? BMO first said about 50,000 (May 2018). The OPC’s later findings put the total at 113,154 across two attack periods; the settlement covered more than 113,000. The later, regulator-sourced figure is used here.
How big was the ransom? The OPC says $1 million in cryptocurrency; Bank Info Security cited CBC for $770,000. The difference may be currency (Canadian vs US dollars); we did not confirm which.
The pattern across the record
One application flaw, found late
The 2018 breach came from a bug in BMO’s own code and from monitoring that missed tens of thousands of lookups from three IP addresses, per the OPC. BMO learned the full scope from the extortionist.
Vendors carry the later exposure
After 2018, the BMO item we found is a US notice sent through a pension-services vendor, consistent with the 2023 wave of MOVEit-related notices.
What it means for BMO clients — and what to do
The 2018 data included Social Insurance Numbers and dates of birth for most affected clients, which do not expire. That is why identity monitoring still matters years later.
1.If you were notified in 2018, keep watching your credit file
A SIN and date of birth can be used for new-credit fraud for years. Ask Equifax and TransUnion Canada about a fraud alert.
Yes. Canada’s Privacy Commissioner found attackers exploited a flaw in BMO’s online banking app between June 2017 and January 2018, affecting 113,154 customers. BMO disclosed it in May 2018 after a ransom demand it refused.
What data was taken in the BMO 2018 breach?+
Per the OPC, the attackers collected an unencrypted session file with extensive customer data; 62,945 affected records included Social Insurance Numbers and dates of birth. The data of 3,190 customers was posted publicly after BMO refused to pay.
Was there a BMO data breach settlement?+
Yes. An Ontario court approved a $21.2 million settlement for more than 113,000 BMO clients in April 2021, and search results show a Quebec court approved a separate settlement in June 2021.
Did BMO pay the ransom?+
No. The OPC says BMO refused the $1 million cryptocurrency demand, after which the extortionist posted some customer data.
Was BMO affected by MOVEit or SitusAMC?+
A 2023 BMO Bank N.A. notice sent through the vendor PBI appears in Maine’s breach list (seen via search), and PBI was a MOVEit victim. We found no reporting naming BMO in the 2025 SitusAMC or Fried Frank incidents.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by BMO. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.