One in Six Canadian Businesses Was Hit by a Cyber Incident in 2025, StatCan Says

About one in six Canadian businesses was hit by a cyber security incident in 2025. Statistics Canada released the figures in The Daily on Wednesday, October 21, 2026, from its Canadian Survey of Cyber Security and Cybercrime. The headline number did not move from 2023, but what sits underneath it did. Scams and fraud now account for a clear majority of the incidents businesses reported, while ransomware has fallen back sharply.

That shift matters because it changes where the risk actually lives. A few years ago, the defining business cyber story was a locked network and a ransom demand. In 2025, according to the survey, the more common story was a person inside the business being tricked.

What Statistics Canada counted

The survey is not a count of every suspicious email or blocked login attempt. It asks businesses whether they were impacted by a cyber security incident, and what form that incident took. The 2025 data were collected from January to March 2026, so the figures describe incidents in the previous calendar year as businesses remembered and classified them.

The survey covers businesses with 10 or more employees and leaves out public administration. It counts only incidents that businesses themselves considered impactful. The overall share, 16 percent, is the same as in 2023 and lower than the 21 percent recorded in 2019. Statistics Canada notes that the gap between business sizes has been shrinking since then.

Large businesses were still the most likely to be impacted, but the difference is no longer as wide as it once was. Small businesses, defined as having 10 to 49 employees, reported an impact rate of 15 percent. Medium businesses, with 50 to 249 employees, reported 21 percent. Large businesses, with 250 or more employees, reported 25 percent.

The shift from ransomware to scams

Among businesses that were impacted in 2025, 55 percent were hit by scams and fraud. That is up from 50 percent in 2023 and 44 percent in 2021. It is the clearest trend in the release, and it has now run in the same direction for three survey rounds in a row.

Identity theft affected 28 percent of impacted businesses in 2025. The exploitation of software, hardware, or network vulnerabilities affected 23 percent. Statistics Canada said each of those two categories fell three percentage points from 2023. Ransomware, by contrast, dropped to 8 percent of impacted businesses, down from 13 percent in 2023 and 11 percent in 2021.

A falling share does not mean ransomware has gone away, and it does not mean the attacks that do happen are harmless. It means that, among businesses that reported an impactful incident, ransomware made up a smaller slice in 2025 than before. Among impacted businesses in 2025, 84 percent did not make a ransom payment.

What businesses spend on protection

Most firms in the survey had at least some protection in place. About 86 percent used at least one cyber security prevention measure. The most common were email security, used by 73 percent, anti-malware software, used by 69 percent, and network security, used by 67 percent.

Average spending on prevention was 54,772 dollars in 2025, compared with 53,907 dollars in 2023. The most common arrangements for managing the risk were an employee overseeing it, reported by 46 percent, data backups, reported by 43 percent, and an outside consultant or contractor, reported by 38 percent.

Insurance is up, claims are down, and few report to police

Cyber risk insurance has spread quickly in Canada. The share of businesses holding a policy reached 34 percent in 2025, up from 22 percent in 2023 and 16 percent in 2021. Among large businesses, 63 percent had a policy. Few of those policies were used. Among insured businesses that were impacted by an incident, only 6 percent attempted a claim in 2025, down from 9 percent in 2023. The survey does not explain that drop in detail. Some incidents may have fallen below a deductible, some may have been handled internally, and some businesses may not have known what their policy covered.

Only 11 percent of impacted businesses reported an incident to police in 2025, down from 13 percent in 2023. Among businesses that did not report any incidents in 2025, 45 percent said the incident was resolved internally. About 33 percent said it was considered too minor. About 27 percent said there was no requirement to report it. Those reasons can overlap. A business that quietly resets passwords and moves on may see no benefit in a police report, especially if no money was lost.

October is Cyber Security Awareness Month in Canada, and the federal Get Cyber Safe campaign runs with advice from the Canadian Centre for Cyber Security. This year its theme is “Your best defence is you,” which fits a year in which scams aimed at staff were the leading method of attack. Businesses targeted by fraud can report it to the Canadian Anti-Fraud Centre, and the Competition Bureau advises reporting to local police as well, and always calling police if money was lost. The 2025 figures do not point to a single fix. They point to a change in emphasis: from locked files to tricked people, and from tools alone to the habits of the people who use them every day.

Frequently Asked Questions

What did Statistics Canada find about cyber incidents in 2025?

About 16 percent of Canadian businesses with 10 or more employees were impacted by a cyber security incident in 2025, the same share as in 2023. Among impacted businesses, 55 percent were hit by scams and fraud, up from 50 percent in 2023, while ransomware fell to 8 percent, down from 13 percent in 2023.

Which businesses were most likely to be hit?

Large businesses, with 250 or more employees, were the most likely to be impacted, at 25 percent. Medium businesses reported 21 percent and small businesses, with 10 to 49 employees, reported 15 percent. Statistics Canada said the gap between business sizes has been shrinking since 2019.

Why do so few businesses report cyber incidents to police?

Only 11 percent of impacted businesses reported an incident to police in 2025. Among businesses that did not report, the main reasons were that the incident was resolved internally, at 45 percent, was considered too minor, at 33 percent, or did not have to be reported because there was no requirement, at 27 percent.