Cyberattack figures often circulate without sources or come from foreign contexts. Here is reliable Canadian data, and above all what it means for an SMB.
Fewer businesses affected, but costlier incidents
According to Statistics Canada's Canadian Survey of Cyber Security and Cybercrime, about one in six Canadian businesses (16%) was impacted by a cyber security incident in 2023, down from 18% in 2021 and 21% in 2019. Good news: basic measures work.
However, spending on recovery from incidents roughly doubled, to about $1.2 billion. In other words, when an incident happens, it costs more.
Fraud and identity theft lead the way
Among impacted businesses in 2023, half experienced scams and fraud, and nearly one in three identity theft. These attacks target people first: the fake invoice, the fake supplier, the urgent "CEO".
That is why employee training and simple verification procedures (for example, confirming any change of banking details by phone) are among the most cost-effective measures.
AI changes the game
CIRA's 2025 Cybersecurity Survey shows that security decision-makers are particularly concerned about data collected by AI tools and about AI-improved phishing. Fraudulent messages are now better written, in English and in French.
The takeaway
Statistics are not meant to scare. They show where to invest first:
- train teams to recognize fraud and phishing;
- turn on multi-factor authentication everywhere;
- actually test backups;
- prepare an incident response plan;
- govern the use of AI.
All of these are among the Canadian Centre for Cyber Security's 13 baseline controls. To see where your business stands, start with the Cyber & AI Assessment.
Sources: Statistics Canada, The Daily, October 21, 2024; CIRA 2025 Cybersecurity Survey.