Updated November 2026.
In recent years, cyberattacks have hit organizations of every size in Quebec and across Canada: retailers, manufacturers, schools, public bodies. The lesson is clear: no sector is immune, and SMBs are targets, often because they are seen as less prepared.
What incidents have in common
Beyond the headlines, reported incidents often follow similar scenarios:
- access gained through a fraudulent email or stolen credentials, without MFA;
- an unpatched system exposed to the internet;
- backups compromised along with systems, because they were not isolated;
- an improvised response, for lack of a plan.
The Canadian context
Federally, the Critical Cyber Systems Protection Act, enacted by Bill C-8 in June 2026, now imposes obligations on designated operators in critical sectors (finance, energy, telecommunications, transportation). Most SMBs are not directly covered, but those serving these organizations may face stronger requirements from their clients.
Privacy laws (PIPEDA federally, Law 25 in Quebec) already require breach records and notifications when there is a significant risk of harm.
Recommendations that make a difference
- Patch automatically systems and software.
- Train staff to recognize phishing and fraud.
- Adopt clear rules for passwords, access and AI use.
- Back up critical data often, offline or isolated, and test restores.
- Prepare and test an incident response plan.
These measures are at the core of the 13 baseline controls. To see where you stand, start with the Cyber & AI Assessment.