Toronto-based hedge fund manager Waratah Capital Advisors, which oversees CAD4bn in assets, is investigating a cybersecurity breach that may have exposed sensitive client information, according to a report by the Globe & Mail.

The report cite the firm as revealing the breach in a letter to investors this week, stating that an unauthorised party accessed data through a third-party IT provider, rather than directly penetrating Waratah’s internal network. The breach, discovered on 24 June, involved the firm’s backup systems, where key investor information was stored.

Waratah serves high-net-worth individuals, family offices, pension plans, and foundations. While the full extent of the breach remains under investigation, preliminary findings indicate that personal information potentially accessed includes investor names, addresses, dates of birth, phone numbers, SINs, account numbers, and investment amounts.

Cyber threats have become increasingly frequent in the asset management industry, with smaller firms often targeted through their vendors. Waratah’s incident follows a growing list of attacks on financial institutions and underscores the vulnerability of outsourced IT systems.

Founded in 2010 by Blair Levinsky and Brad Dunkley, Waratah is one of Canada’s more prominent hedge fund managers. The firm said its investigation is ongoing and could take several weeks to complete.