About 1 in 6 Canadian businesses, or 16%, were hit by a cyber security incident in 2023, the latest Statistics Canada survey year, and their recovery spending doubled to $1.2 billion while prevention and detection spending reached $11.0 billion. Ransomware hit 13% of affected businesses and 88% of those victims refused to pay, while Canadians reported a record $704 million in fraud losses in 2025 and the Canadian Centre for Cyber Security handled 3,216 incidents in fiscal 2025-26.
Canadian Business Cybercrime 2026 – Introduction
Canadian business cybercrime describe a threat that is less frequent than it used to be but far more expensive when it lands. Fewer firms report incidents than in 2019, yet the cost of cleaning up after an attack has doubled, and the dollars lost to online fraud keep setting records. Small firms, hospitals, municipal governments and large banks all face the same toolkit: phishing, stolen passwords, extortion and ransomware.
2026 brings fresh data from several agencies. Police have published cybercrime rates through 2025, the fraud centre has closed its books on last year, and the national cyber agency has reported its busiest year on record. The main business survey is still two years old, so the picture mixes recent and older numbers. This report covers attack rates, losses, ransomware, fraud, police data and industry risks, one data table at a time.
Interesting Facts About Canadian Business Cybercrime 2026
BUSINESSES IMPACTED BY CYBER SECURITY INCIDENTS, CANADA
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2019 █████████████████████ 21%
2021 ██████████████████ 18%
2023 ████████████████ 16%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Interesting Fact | 2026 Data |
|---|---|
| Businesses impacted by an incident, 2023 | 16%, down from 21% in 2019 |
| Recovery spending, 2023 | $1.2 billion, double the $600 million of 2021 |
| Prevention and detection spending, 2023 | $11.0 billion, up from $9.7 billion |
| Ransomware share of incidents, 2023 | 13% of impacted businesses |
| Ransomware victims who did not pay | 88% |
| Reported fraud losses, 2025 | $704 million across 112,000+ reports |
| Cyber Centre incidents, fiscal 2025-26 | 3,216 |
| Average cost of a data breach in Canada, 2026 | $7.11 million (IBM) |
Source: Statistics Canada, Canadian Survey of Cyber Security and Cybercrime 2023; Canadian Anti-Fraud Centre; Communications Security Establishment annual report 2025-26; IBM Cost of a Data Breach Report 2026, as reported.
The first five rows show the survey results. The share of businesses hit fell from 21% in 2019 to 16% in 2023, but recovery spending doubled to $1.2 billion, so each incident costs more. Prevention and detection spending rose more slowly, from $9.7 billion to $11.0 billion. Ransomware reached 13% of impacted businesses, and 88% of those victims did not pay.
The last three rows add recent signals. The Canadian Anti-Fraud Centre logged $704 million in reported fraud losses in 2025, the most on record, and the national Cyber Centre responded to 3,216 incidents in fiscal 2025-26. IBM puts the average Canadian data breach at $7.11 million. The most recent business survey covers 2023, and Statistics Canada collected the 2025 edition from January to March 2026, with results not yet published.
Canadian Business Cyber Attack Rates 2026 | Size, Insurance and Police Reporting
BUSINESSES IMPACTED BY SIZE, 2023
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Large businesses (250+ employees) ███████████████ 30%
All businesses ████████ 16%
Small businesses (10-49 employees) ███████▏ 14.3%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Attack Rate Metric | 2023 Data |
|---|---|
| All businesses impacted | 16% (18% in 2021, 21% in 2019) |
| Large businesses impacted | 30% |
| Small businesses impacted | 14.3%, down from 18.8% in 2017 |
| Businesses with cyber risk insurance | 22%, up from 16% |
| Impacted businesses that reported to police | 13%, up from 10% |
| Businesses with written cyber security policies | 26% |
| Businesses offering formal skills training to non-IT staff | 22% |
| Most common attack methods | Scams and fraud, in about half of incidents |
Source: Statistics Canada, The Daily, October 21, 2024; Cybersecurity Canada Small Business Cyber Risk Report, October 11, 2026.
Size drives exposure. Large firms were hit most often, with 30% impacted, against 16% of all businesses and 14.3% of small ones. Small business incidents have fallen from 18.8% in 2017, but their exposure is still heavy relative to their security staff. Fraud and scams caused about half of the incidents among affected firms, ahead of ransomware.
Preparedness remains thin. Only 26% of businesses had written cyber security policies and 22% offered formal training beyond IT staff. Cyber risk insurance rose to 22% from 16%, and reporting to police rose to 13% from 10%. That means roughly 87% of impacted firms never tell the police, which leaves the official crime numbers well below reality.
Canadian Business Cybercrime Costs 2026 | Recovery and Prevention Spending
SPENDING ON CYBER SECURITY, CANADA 2023 (billions)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Prevention and detection ████████████████████████████████████████████ 11.0
Salaries for prevention ███████████████ 3.8
Security software ████████████ 2.9
Consultants, contractors ████████ 1.9
Recovery from incidents █████ 1.2
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Cost Metric | Data |
|---|---|
| Total recovery spending, 2023 | $1.2 billion ($600 million in 2021) |
| Recovery by large businesses | About $500 million |
| Recovery by medium businesses | About $300 million |
| Recovery by small businesses | About $300 million |
| Total prevention and detection spending | $11.0 billion ($9.7 billion in 2021) |
| Employee salaries for prevention or detection | $3.8 billion |
| Cyber security software | $2.9 billion |
| Consultant and contractor expenses | $1.9 billion |
Source: Statistics Canada, Canadian Survey of Cyber Security and Cybercrime 2023, The Daily, October 21, 2024.
Recovery is the fast-growing bill. Spending to recover from incidents doubled from about $600 million in 2021 to $1.2 billion in 2023, even though fewer firms were hit. Large businesses accounted for about $500 million, and medium and small businesses for about $300 million each. Prevention spending rose only from $9.7 billion to $11.0 billion, so recovery is still a small share of the total, but the ratio is moving in the wrong direction.
Prevention spending shows where the money goes. Employee salaries for prevention or detection cost $3.8 billion, software $2.9 billion and consultants and contractors $1.9 billion. IBM’s 2026 Cost of a Data Breach report puts the average Canadian breach at $7.11 million, a record, up from $6.98 million a year earlier. These figures cover very different things, so they should not be added together.
Ransomware in Canada 2026 | Payments, Victims and Threat Outlook
HOW RANSOMWARE VICTIMS RESPONDED, 2023
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Did not pay the ransom █████████████████▌ 88%
Paid the ransom ██▍ 12%
Of payers, paid under $10,000 ████████████████▊ 84%
Of payers, paid over $500,000 ▊ 4%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Ransomware Metric | Data |
|---|---|
| Share of impacted businesses hit by ransomware, 2023 | 13% (11% in 2021) |
| Ransomware victims that did not pay | 88% |
| Payers who paid less than $10,000 | 84% |
| Payers who paid more than $500,000 | 4% |
| Small Canadian businesses that run ransomware drills, January 2026 | 11% (Get Cyber Safe survey of 300 firms) |
| Small businesses storing backups offline | 34% |
| Cyber Centre assessment | Ransomware is the top cybercrime threat to critical infrastructure |
| Cyber Centre outlook period | 2025 to 2027 |
Source: Statistics Canada, The Daily, October 21, 2024; Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025-2027; Communications Security Establishment Get Cyber Safe tracking survey, 2026.
Ransomware affected 13% of impacted businesses in 2023, up from 11% in 2021. Most victims refused to pay: 88% did not hand over money, and among the 12% who paid, 84% paid less than $10,000 while 4% paid more than $500,000. The Cyber Centre calls ransomware the top cybercrime threat to critical infrastructure, and its 2025 to 2027 outlook expects the threat to continue.
Preparation still lags. A January 2026 Get Cyber Safe survey of 300 small business owners found only 11% run ransomware simulations and 34% store backups offline. Half said recovery would take some or considerable effort. Refusing to pay works only if backups work, so the gap between the 88% who refused and the minority that rehearse recovery is the number to watch.
Fraud and Scam Losses in Canada 2026 | Canadian Anti-Fraud Centre Data
REPORTED FRAUD LOSSES BY TYPE IN 2025 (CAD millions)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Investment fraud ███████████████████████████████████ 351
Spear phishing ██████▊ 67.9
Relationship scams ██████▎ 63.3
Job scams █████ 50.6
Fraud investigator ██▊ 28.3
Recovery pitch ██▌ 25.9
Extortion ██▎ 23
Service scams █▉ 19.5
Merchandise █▏ 11.7
Prize scams ▌ 5.7
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Fraud Type, 2025 | Reports | Victims | Dollar Loss |
|---|---|---|---|
| Investment | 4,409 | 3,867 | $351 million |
| Spear phishing | 813 | 571 | $67.9 million |
| Relationship | 1,093 | 933 | $63.3 million |
| Job | 2,148 | 1,726 | $50.6 million |
| Fraud investigator | 2,167 | 1,137 | $28.3 million |
| Extortion | 2,767 | 835 | $23 million |
| Service | 3,393 | 2,444 | $19.5 million |
| All fraud reported | 112,000+ | Not shown | $704 million |
Source: Canadian Anti-Fraud Centre, Top 10 Frauds in 2025, February 2026.
Reported fraud losses hit $704 million in 2025 on more than 112,000 reports, a record. The 2024 total was about $645 million, so 2025 set a new all-time record high. Investment fraud dominates, with 4,409 reports and $351 million in losses, about half of the total. Spear phishing, the type aimed at employees and executives, cost $67.9 million from just 813 reports, making it one of the costliest per victim. Relationship scams took $63.3 million and job scams $50.6 million.
The fraud centre estimates that only 5% to 10% of victims report, so the true toll is far larger. Business-targeted tricks such as fraud investigator calls ($28.3 million) and extortion ($23 million) are smaller but fast-growing. Microsoft 365 credentials are a prime target for spear phishing, a trend covered in the Microsoft facts and statistics in the US report. One lost password can open email, files and bank approvals.
Canadian Cyber Survey Findings 2026 | CIRA and Get Cyber Safe Results
CANADIAN ORGANIZATIONS TARGETED AND BREACHED (CIRA)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Targeted by a cyber attack, 2025 █████████████████████▌ 43%
Breached in past 12 months, 2025 █████████████████████ 42%
Breached in 2022 ██████████████▌ 29%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Survey Metric | Data |
|---|---|
| Organizations targeted by a cyber attack, past 12 months | 43% (CIRA 2025) |
| Organizations breached, past 12 months | 42%, up from 29% in 2022 |
| Canadians worried about AI-related cybercrime, 2026 | 73%, up from 65% in 2024 |
| Canadians who were victims of a ransomware attack | 4% (Get Cyber Safe 2026) |
| Small businesses that run ransomware drills | 11% |
| Small businesses that store backups offline | 34% |
| Small businesses saying recovery would take some effort | 38% |
| Small businesses saying recovery would be difficult | 13% |
Source: Canadian Internet Registration Authority 2025 Cybersecurity Survey; Communications Security Establishment Get Cyber Safe Awareness Tracking Survey, January 2026.
Industry surveys show a higher hit rate than Statistics Canada’s. The Canadian Internet Registration Authority found 43% of organizations were targeted by a cyber attack in the past year and 42% were breached, up from 29% in 2022. The sample skews toward IT decision-makers at larger organizations, which explains why the numbers sit above Statistics Canada’s 16% for all businesses. The two sources measure different groups, so they should be read side by side and not blended.
Attitudes and readiness lag. The Get Cyber Safe tracking survey found 73% of Canadians worry about AI-related cybercrime, up from 65% in 2024, while only 11% of small businesses run ransomware drills and 34% keep offline backups. Among small firms, 38% say recovery would take some effort and 13% say it would be difficult. Worry is growing faster than preparation, which is the gap attackers use.
Police-Reported Cybercrime in Canada 2026 | Incidents per 100,000 and Fraud Share
POLICE-REPORTED CYBERCRIME RATE PER 100,000 CANADIANS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2018 █████████▏ 91.9
2024 ██████████████████████▌ 225.1
Larger cities, 2024 ███████████████████████▊ 237.7
Smaller towns, 2024 ██████████████████▋ 186.8
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Police Cybercrime Metric | Data |
|---|---|
| Incident rate, 2018 | 91.9 per 100,000 |
| Incident rate, 2024 | 225.1 per 100,000 |
| Rate in larger cities, 2024 | 237.7 |
| Rate in smaller towns, 2024 | 186.8 |
| Cyber-related fraud incidents, 2024 | 46,301, almost half of all cybercrime |
| Police-reported crimes with a cyber component, 2024 | About 4% |
| Cybercrime incidents, first half of 2025 | 40,437 |
| Individuals who experienced an incident, 2022 | 70%, up from 58% in 2020 |
Source: Statistics Canada, Uniform Crime Reporting Survey and Canadian Internet Use Survey; Statistics Canada, Computer Security Day every day.
Police-reported cybercrime more than doubled, from 91.9 incidents per 100,000 people in 2018 to 225.1 in 2024. Fraud made up 46,301 incidents in 2024, almost half of the total, and about 4% of all police-reported crimes had a cyber component. Cities lead with 237.7 against 186.8 in smaller towns. Police counted 40,437 incidents in the first half of 2025 alone, so the pace has not slowed.
These figures cover all victims, not just businesses. About 70% of Canadians aged 15 and older experienced a cyber security incident in 2022, up from 58% in 2020 and 52% in 2018. Worry is rising too, and a January 2026 survey found 73% of Canadians are concerned about AI-related cybercrime, up from 65% a year earlier. The shift to AI-assisted scams is tracked in the AI search statistics report.
Small Business Cybercrime in Canada 2026 | Costs, Policies and Ransomware Exposure
SMALL BUSINESS CYBER FACTS (each █ = 5 points or $50 million as labeled)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Small businesses impacted, 2023 ███▏ 14.3%
Small business recovery spending ██████ $300 million
Ransomware victims that were SMBs (Verizon) ███████████████████▏ 96%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Small Business Metric | Data |
|---|---|
| Small businesses (10 to 49 employees) impacted, 2023 | 14.3%, down from 18.8% in 2017 |
| Small business recovery spending, 2023 | About $300 million |
| Small business prevention and detection spending | About $2.6 billion |
| Ransomware victims with a known size that were small or medium | About 96% (Verizon 2026 data) |
| Businesses with written cyber security policies | 26% |
| Businesses offering formal cyber skills training | 22% |
| Businesses with cyber risk insurance | 22% |
| Businesses that report incidents to police | 13% |
Source: Statistics Canada, Canadian Survey of Cyber Security and Cybercrime 2023; Verizon 2026 Data Breach Investigations Report, as reported by Cybersecurity Canada, October 11, 2026.
Small firms are the biggest group and often the least protected. About 14.3% of Canadian businesses with 10 to 49 employees were impacted by an incident in 2023, down from 18.8% in 2017. They spent about $300 million recovering and about $2.6 billion on prevention and detection. Verizon’s 2026 data found that about 96% of ransomware victims with a known size were small or medium businesses, defined as under 1,000 employees.
Policies are the weak spot. Only 26% of businesses had written cyber security policies in 2023, and just 22% offered formal skills training or held cyber risk insurance. A small firm that depends on one owner’s email account can lose everything to one stolen password. Only 13% of impacted businesses told police, so many small incidents never reach official statistics, and the survey results understate the number of firms that were attacked.
Cyber Centre Incidents in Canada 2026 | Critical Infrastructure and Industry Risks
INCIDENTS HANDLED BY THE CANADIAN CENTRE FOR CYBER SECURITY (each █ = 100)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2023-24 ██████████████████████ 2,192
2024-25 ██████████████████████████ 2,561
2025-26 ████████████████████████████████▏ 3,216
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Industry or Incident Metric | Data |
|---|---|
| Cyber Centre incidents, 2025-26 | 3,216 |
| Cyber Centre incidents, 2024-25 | 2,561, of which 1,406 involved critical infrastructure |
| Cyber Centre incidents, 2023-24 | 2,192 |
| Finance and insurance, businesses targeted, 2023 | 25.5% |
| Information and cultural industries, 2023 | 24.7% |
| Professional, scientific and technical services, 2023 | 21.1% |
| Educational services, 2023 | 15.6% |
| Health care and social assistance, 2023 | 12.2% |
Source: Communications Security Establishment Canada annual reports 2023-24 to 2025-26; Statistics Canada Table 22-10-0076-01 as compiled in a public dashboard; Statistics Canada, The Daily, October 20, 2020.
The national cyber agency’s workload keeps climbing. It handled 3,216 incidents in fiscal 2025-26, up from 2,561 in 2024-25 and 2,192 in 2023-24. In 2024-25, 1,406 of the 2,561 incidents involved critical infrastructure such as energy, finance, health and telecommunications. The National Cyber Threat Assessment 2025-2026 names ransomware as the top cybercrime threat to those sectors.
Industry risk varies. In the 2023 survey, finance and insurance firms were most often impacted at 25.5%, followed by information and cultural industries at 24.7% and professional, scientific and technical services at 21.1%. Education followed at 15.6% and health care and social assistance at 12.2%. Trade-heavy sectors face supply-chain exposure, as the US trading partners statistics report shows for cross-border commerce. In 2019, wholesale trade had the second-highest rate at 34%.
Canadian Business Cybercrime FAQs 2026
How many Canadian businesses are hit by cyber attacks?
About 1 in 6, or 16%, were impacted by a cyber security incident in 2023, according to Statistics Canada. Large businesses had a higher rate of 30%.
How much does cybercrime cost Canadian businesses?
Canadian businesses spent $1.2 billion recovering from incidents in 2023, double 2021, and $11.0 billion on prevention and detection.
What is the average cost of a data breach in Canada in 2026?
IBM’s 2026 report puts it at $7.11 million, a record, up from $6.98 million.
How common is ransomware in Canada?
Ransomware hit 13% of impacted businesses in 2023, up from 11% in 2021.
Do Canadian businesses pay ransomware demands?
Mostly not. 88% of ransomware victims did not pay in 2023, and of the 12% who did, 84% paid less than $10,000.
How much did Canadians lose to fraud in 2025?
The Canadian Anti-Fraud Centre recorded $704 million in reported losses from more than 112,000 reports, a record. Investment fraud accounted for $351 million.
How many cybercrime incidents do police report in Canada?
225.1 incidents per 100,000 people in 2024, more than double the 91.9 recorded in 2018.
How many incidents did the Canadian Cyber Centre handle in 2025-26?
3,216, up from 2,561 in 2024-25 and 2,192 in 2023-24.
Which industries face the most cyber attacks in Canada?
In 2023, finance and insurance (25.5%) and information and cultural industries (24.7%) were hit most often, followed by professional services (21.1%).
How many Canadian businesses have cyber insurance?
22% in 2023, up from 16% in 2021.
How many businesses report cyber incidents to police?
About 13% of impacted businesses in 2023, up from 10% in 2021.
How many small businesses are hit by cybercrime?
14.3% of small businesses (10 to 49 employees) were impacted in 2023, down from 18.8% in 2017.
How many Canadian organizations were breached in the past year?
The Canadian Internet Registration Authority found 42% were breached and 43% were targeted in its 2025 survey, up from 29% breached in 2022.
How worried are Canadians about AI-related cybercrime?
73% said they were concerned in the Get Cyber Safe 2026 survey, up from 65% in 2024.
What share of small businesses back up data offline?
Only 34%, according to the January 2026 Get Cyber Safe survey of 300 small business owners and managers.
What are the biggest fraud types hitting Canadians?
Investment fraud led with $351 million in 2025 losses, followed by spear phishing ($67.9 million), relationship scams ($63.3 million) and job scams ($50.6 million).
How much do small businesses spend on cyber security?
About $2.6 billion on prevention and detection and about $300 million on recovery in 2023.
How much of fraud is reported in Canada?
The Canadian Anti-Fraud Centre estimates only 5% to 10% of victims report fraud.
What is the Canadian Survey of Cyber Security and Cybercrime?
Statistics Canada runs it for Public Safety Canada every two years. The 2023 results were released on October 21, 2024.
How many incidents involved critical infrastructure?
1,406 of the 2,561 incidents the Cyber Centre handled in 2024-25 involved critical infrastructure.
Is ransomware the top cyber threat in Canada?
Yes. The Cyber Centre calls ransomware the top cybercrime threat facing Canada’s critical infrastructure.
How much do businesses spend on cyber security software?
$2.9 billion in 2023, behind $3.8 billion in salaries for prevention or detection.
What share of businesses have written cyber policies?
Only 26% in 2023, according to Statistics Canada.
What share of police-reported cybercrime is fraud?
Cyber-related fraud made up 46,301 incidents in 2024, almost half of all police-reported cybercrime.
When will new Statistics Canada cyber survey results come out?
Statistics Canada collected the 2025 survey from January to March 2026, and results are not yet published.
Disclaimer: This research report is compiled from publicly available sources. While reasonable efforts have been made to ensure accuracy, no representation or warranty, express or implied, is given as to the completeness or reliability of the information. We accept no liability for any errors, omissions, losses, or damages of any kind arising from the use of this report.