Skip to content
Breach Index · running record

RBC data breach history (2016-2026): the Carney insider case and vendor card exposures

Royal Bank of Canada’s best-known recent incident is an insider case: an Ottawa branch employee who viewed Prime Minister Mark Carney’s banking profile and opened fraudulent accounts with stolen identities. Earlier, RBC card holders were exposed through two vendors, Travelocity and Equifax. This page covers RBC and RBC Capital Markets, with dates and sources.

Short answer

Was RBC hacked?

We found no confirmed breach of RBC’s own systems by an outside attacker from 2016 to 2026 in the sources we read. The main incident was an insider. RBC said in September 2025 that it “independently identified unauthorized system access” by an employee and called in police. Per Global News, the former employee, Ibrahim El-Hakim, viewed the banking profiles of Mark Carney and two others on 17 June 2025 and opened at least 43 fraudulent accounts between November 2023 and June 2025. He pleaded guilty to fraud over $5,000, unauthorised use of a computer and identity theft. RBC paid $14,634 for two years of credit monitoring for 27 clients whose identities were stolen.

In January 2018 RBC told card holders that Travelocity, which ran its travel rewards platform, had exposed card numbers and security codes used on that site between 3 October and 22 December 2017, adding that the incident “does not involve RBC’s own systems.” In September 2017 RBC said the Equifax breach had affected a “small number” of its credit card holders.

Timeline at a glance

  1. 4 Nov 2026Former RBC employee found guilty after viewing Carney’s profile and opening fraudulent accounts. (Global News)Confirmed
  2. 24 Sep 2025RBC says it found the employee’s unauthorised system access and engaged police; charges laid. (BNN Bloomberg)Confirmed
  3. Nov 2025 – Jan 2026RBC not named in coverage of the SitusAMC or Fried Frank vendor breaches. (Bank Info Security)Not a breach
  4. 26 Jan 2018RBC notice: Travelocity’s rewards platform exposed card numbers and CVVs (Oct-Dec 2017). (RBC letter (Montana DOJ))Confirmed
  5. 21 Sep 2017Equifax breach affected a “small number” of RBC credit card holders. (CTV / Canadian Press)Reported

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

RBC incident timeline, in detail

Confirmed = acknowledged by RBC, a regulator filing or a court. Reported = credible reporting RBC has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Nov 2023 – Jun 2025ConfirmedInsider misuse / identity fraud

Branch employee views PM Carney’s profile and opens fraudulent accounts

What happened. RBC said it “independently identified unauthorized system access”, engaged the authorities and dismissed the employee. The RCMP arrested Ibrahim El-Hakim, an employee at a downtown Ottawa branch, in July 2025. Per the agreed facts reported by Global News, he opened at least 43 fraudulent accounts between November 2023 and June 2025 using stolen identity information (names, dates of birth, social insurance numbers, driving licence and passport data, per court records as reported (via search)), and on 17 June 2025 viewed the banking profiles of Mark Carney, a profile in the name Justin Trudeau that did not belong to the former prime minister, and one other person.

Impact. He pleaded guilty to fraud over $5,000, unauthorised use of a computer and identity theft (Global News, November 2026). RBC paid $14,634 for two-year credit monitoring for 27 clients whose identities were stolen. The RCMP said it saw no threat to Carney’s safety and has not said whether his information was shared.

Sources: Global News, 4 Nov 2026 · BNN Bloomberg, 24 Sep 2025

Oct – Dec 2017ConfirmedThird-party / rewards platform

Travelocity-run RBC Travel Rewards site exposes card numbers and CVVs

What happened. RBC noticed increased fraud on RBC cards used on its travel rewards redemption platform, operated by Travelocity, and told Travelocity. On 5 January 2018 Travelocity confirmed unauthorised access to the platform. RBC and Travelocity sent notices dated 26 January 2018. RBC wrote that “this incident does not involve RBC’s own systems.”

Impact. Card number and CVV for cards used on the RBC Travel Rewards site between 3 October and 22 December 2017. The notice says bank account information and Social Security numbers were not stored on the platform. RBC called it “a limited number of individuals” and gave no count.

Sources: RBC and Travelocity notice, 26 Jan 2018 (Montana DOJ)

Sep 2017ReportedThird-party / credit bureau

Equifax breach reaches a small number of RBC credit card holders

What happened. The Canadian Press reported that the 2017 Equifax breach affected a “small number” of RBC credit card holders. The breach was at Equifax, not RBC.

Impact. We could read only the headline and date of the report, not the number of clients or the data involved.

Sources: CTV News / Canadian Press, 21 Sep 2017

Where the reports disagree

  • Was El-Hakim “found guilty” or did he plead guilty? Global News’s November 2026 headline says found guilty; its article says he pleaded guilty to the three counts in August. The fourth charge laid in 2025, trafficking in identity information, is not among them.

The pattern across the record

The insider used ordinary branch access

Viewing a famous client’s profile and opening accounts with stolen identities both used the access a branch employee has. RBC’s own monitoring found it, but only after about 19 months of fraudulent account openings.

Vendors that touch card data are part of the bank’s exposure

Travelocity and Equifax were outside RBC, yet RBC card holders bore the risk and RBC spotted the Travelocity fraud first.

What it means for RBC clients — and what to do

For RBC clients, the practical risks are identity fraud and card fraud. Monitor your credit and your card statements, and ask about any account you do not recognise.

  1. 1.Check your credit report for accounts you did not open

    The insider opened accounts with stolen identities. Free credit reports from Equifax and TransUnion Canada show new accounts in your name.

    Identity protection lab
  2. 2.Review card activity after any rewards or vendor notice

    Card numbers and CVVs from a rewards site can be used online at once. Ask for a new card if you are notified.

    Breach notice decoder
  3. 3.Be wary of callers claiming to be RBC

    Hang up and call the number on your card if someone asks you to confirm details or move money.

    Voice-clone fraud checklist

CISO takeaways

Rehearse insider data misuse

Practise detection and response when staff use legitimate access to look up or exploit clients.

Insider Data Theft Lab
Have an insider-incident runbook

Security, HR, legal and police need a single plan when it is an employee.

Insider IR checklist
Score vendors that handle card data

Rewards and loyalty platforms take card payments under your brand.

Vendor Risk Scorecard

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Ex-RBC worker found guilty after viewing Carney’s data, opening accounts — Global News, 4 Nov 2026
  2. 2.Canada bank staffer accused of unauthorized viewing of PM Carney’s accounts — BNN Bloomberg, 24 Sep 2025
  3. 3.Notice of data breach involving RBC Travel Rewards website provided by Travelocity — RBC (copy filed with Montana DOJ), 26 Jan 2018
  4. 4.Equifax breach affected “small number” of RBC credit card holders — CTV News / Canadian Press, 21 Sep 2017
  5. 5.Major US banks gauge their exposure to SitusAMC breach — Bank Info Security, 24 Nov 2025
  6. 6.After Goldman, JPMorgan discloses law firm data breach — SecurityWeek, 13 Jan 2026

Frequently asked questions

Was RBC hacked?

We found no confirmed breach of RBC’s own systems by an outside attacker from 2016 to 2026. An RBC employee misused his access between 2023 and 2025, and vendors Travelocity and Equifax exposed some RBC card holders in 2017.

What happened with the RBC employee and Mark Carney?

An Ottawa branch employee viewed Prime Minister Mark Carney’s banking profile on 17 June 2025 and opened at least 43 fraudulent accounts. RBC detected the access and went to police. He pleaded guilty to fraud, unauthorised use of a computer and identity theft.

Is there an RBC data breach in 2025?

The 2025 case was an insider, not a hack. RBC paid for two years of credit monitoring for 27 clients whose identities were stolen. RBC was not named in the coverage we read of the 2025 SitusAMC or Fried Frank vendor breaches.

Was the RBC Travel Rewards site hacked?

The platform, run by Travelocity, was. Card numbers and CVVs used on it between 3 October and 22 December 2017 were likely exposed. RBC said its own systems were not involved.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by RBC. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.