The Canadian lending giant and its subsidiaries collectively disclosed the breach, saying that they discovered it in February.
According to notification letters sent to affected customers, exposed information included Social Security numbers and financial account information as well as other personal details.