Cogeco-owned Oxio suffers data breach, customer data affected

Oxio, a home internet service provider owned by Cogeco, announced that it suffered a data breach.

In an email sent to customers (including MobileSyrup’s own Jon Lamont) on Thursday evening, Oxio said the breach involved a third-party software and service provider and records associated with both current and former accounts. Oxio says that, by law, it must keep its records for a certain period of time after an account is closed.

Oxio says that on Oct. 15, 2026, the data platform of an account management vendor that services Oxio and “several other” telecom companies was hacked. Following the breach, Oxio says it began an investigation with external forensics specialists. The good news is that Oxio says its internal networks and operational structure remain unaffected, and the incident is fully contained.

Oxio said hackers accessed names, email addresses, usernames, physical and mailing addresses, account notes, and statuses. But no passwords or financial information were accessed.

An Oxio customer on Reddit noted some additional details they received in response to an email to Oxio. The response noted that Oxio has “no evidence indicating that financial data was used fraudulently as a result of this incident.” Moreover, Oxio told the Redditor that “no credit card information was taken because our systems do not store or display customer credit card information.”

Comment
by
u/zalier26 from discussion

in
oxio_ca_internet

In its initial email notifying customers of the breach, Oxio said no immediate action is required but advised customers to watch for unsolicited calls, messages, or emails asking for verification codes, and to avoid reusing passwords across multiple services.

We reached out to Cogeco, and they issued this statement in response:

“On October 15, 2026, Cogeco was made aware of a security incident involving one of our third-party software and service providers supporting the oxio brand. Upon learning of this incident, we took immediate action to confirm containment and to understand the impact of the incident. The third-party service provider has confirmed that the incident is fully contained, and we can confirm that Cogeco and oxio’s own internal networks, systems, and operations were not affected and remain secure. We are committed to maintaining the privacy of personal information, and we regret any concern this third-party service provider incident may cause our customers. We have communicated directly with impacted individuals to provide tailored support and guidance.”

Oxio isn’t the only Canadian telecom service provider that’s been affected by a data breach recently. Quebecor’s Freedom suffered two breaches of its customer account management platform; Rogers and its subsidiary Fido suffered a similar breach back in March that leaked names, contact information, account numbers, and language preferences; and Telus suffered a breach that saw customer accounts accessed between Feb. 2025 and June 2026.