Canadian Data Breach Statistics

Statistics Canada reported that 16% of Canadian businesses were affected by cyber security incidents in 2023. Total recovery spending reached $1.2 billion, double the amount reported for 2021. The survey covers enterprises with Canadian operations and at least 10 employees, excluding public administration. Only incidents considered impactful by respondents are included. It is not a census of every organization or attempted attack.

• 16% of surveyed Canadian businesses were affected in 2023
• 30% of large businesses were affected
• Recovery spending reached $1.2 billion
• Scams and fraud affected 50% of impacted businesses
• Identity theft affected 31% of impacted businesses
• Ransomware affected 13% of impacted businesses

Among businesses affected by cyber security incidents in 2023, more than one in eight reported ransomware. Most ransomware victims, 88%, reported that they did not make a ransom payment. Of those that paid, most reported less than $10,000, while a small share reported more than $500,000.

• Restoration, investigation, legal review, notification, downtime, and communication can exceed the demand
• Protected backups need regular restore tests
• Incident decision authority should be established before an attack
• Law enforcement, legal, insurance, privacy, and technical contacts should be documented

The OPC's 2025-2026 annual report records 696 business breach reports under PIPEDA and 451 federal-institution reports under the Privacy Act: 1,147 reports in total. Reports received are not the total number of breaches in Canada.

Keep the earlier source snapshots separate

The October 2025 briefing listed 686 PIPEDA and 613 Privacy Act reports for 2024-2025, totalling 1,299, with 72% involving a real risk of significant harm. The 2024-2025 annual report instead records 615 Privacy Act reports. These published snapshots differ; this compilation does not infer the reason. Keep each source's numbers together rather than substituting one count into another snapshot's total.

• Provincial privacy regulators receive additional reports
• One report can affect one person, many people, or many accounts
• Mandatory reports are not a complete count of attempted attacks
• PIPEDA and Privacy Act figures cover different organizations

Counts of incidents, reports, people, and accounts answer different questions. The 2025-2026 annual report's tables record 20,328,495 affected accounts under PIPEDA and 48,159 under the Privacy Act, a combined 20,376,654 accounts. These counts do not identify unique people.

In fiscal 2023-2024, the OPC reported 693 private-sector breaches affecting about 25 million Canadian accounts. In fiscal 2024-2025, federal institutions reported 615 breaches affecting 309,865 individuals. These should not be added as though they measured the same population.

• An account count can exceed the number of unique people
• A report can cover several events or systems
• A survey incident can occur without a reportable privacy breach
• A privacy breach can result from error, loss, unauthorized access, or a cyber incident

Statistics Canada reported that 13% of affected businesses reported incidents to police in 2023, up from 10% in 2021. Reasons for not reporting every incident included resolving it internally, considering it too minor, or handling it with an IT consultant. Police data alone therefore cannot describe the full scale of business cyber incidents.

Use national figures to support governance and budgeting, not to predict one organization’s exact probability or loss. A useful risk assessment starts with assets, business processes, likely threats, controls, dependencies, recovery needs, and the consequences of disclosure, alteration, or outage.

• Inventory systems, data, administrators, vendors, and backups
• Require strong authentication and separate privileged accounts
• Patch operating systems and applications
• Protect email, endpoints, cloud identities, networks, and remote access
• Prepare and exercise an incident response plan
• Keep protected backups and test complete recovery

Download the statistics as CSV

Suggested citation: North Star IT Services Ltd., Canadian Data Breach Statistics, reviewed October 16, 2026. This is a compilation of Statistics Canada and Office of the Privacy Commissioner figures; cite the linked primary source when reproducing an individual statistic.

The file may be reused with attribution. The underlying government statistics remain subject to their respective source terms.