Two Canadian banks have been targeted by hackers, with financial information relating to about 90,000 customers stolen in what is likely an attempted case of blackmail.

The first of the two banks and Canada’s fourth-largest lender, the Bank of Montreal, said in a statement Monday that fraudsters had contacted it on Sunday claiming that they were in possession of certain personal and financial information for a limited number of customers.

The bank said it believes the fraudsters obtained data relating to fewer than 50,000 of the bank’s 8 million customers. “We have notified and are working with relevant authorities as we continue to assess the situation,” the bank noted, adding that they believe the attack originated from outside the country.

Simpii Financial, a subsidiary of the Canadian Imperial Bank of Commerce, reported an incident the same day. It advised clients that it has implemented additional security in response to a claim received Sunday that fraudsters “may have electronically accessed certain personal and account information for approximately 40,000 of Simplii’s clients.”

What information was stolen was not made clear by either bank, but it would appear that the breaches may include direct access to customer accounts. CBC reported that one customer had a fraudulent transfer for $980 sent from his Simplii Financial account on Saturday.

Simplii and BOM described the way they became aware of customer data being stolen using different wording and clearly left some facts out. But the odds of both hacks happening coincidentally are highly unlikely.

An educated guess is that both banks were given ransom demands. CNBC notes that “the fraudsters had threatened to make the [BOM] data public,” meaning that the motivation had to have been a demand for payment, such as bitcoin or Monero. It wouldn’t be the first time hackers have attempted to blackmail companies in return for not releasing private data, Uber Technologies Inc. being a previous example.

Photo: Wikimedia Commons