The Daily — Impact of cybercrime on Canadian businesses, 2025

Since 2017, the Canadian Survey of Cyber Security and Cybercrime ( CSCSC ) has measured the evolution of the impact of cyber security on Canadian businesses. This includes the types of cyber security incidents that are impacting businesses, the prevention measures businesses are taking, and the repercussions of these incidents.

The release of 2025 data from the CSCSC coincides with Cyber Security Awareness Month, which is an internationally recognized campaign held each October to inform the public of the importance of cyber security.

one in six Canadian businesses were impacted by cyber security incidents in 2025

In 2025, one in six (16%) Canadian businesses were impacted by cyber security incidents, unchanged from 2023, but five percentage points lower than 2019 (21%).

In 2025, large businesses in Canada remained the most likely to be impacted by a cyber security incident (25%), compared with small (15%) and medium (21%) businesses. However, the gap between business sizes has been shrinking since 2019.

Chart 1 Businesses impacted by cyber security incidents, Canada, 2019 to 2025

Scams and fraud continue to have the most widespread impact on businesses

Scams and fraud were identified as a method of attack for over half (55%) of the businesses impacted by cyber security incidents in 2025. The pervasiveness of this method has continued to increase since 2023 (50%) and 2021 (44%).

The other commonly identified methods of attack in 2025 were identity theft (28%) and the exploitation of software, hardware or network vulnerabilities (23%), each of which has decreased by three percentage points since 2023.

In 2025, 8% of impacted businesses indicated that an incident involved ransomware, a notable decline after increasing from 11% in 2021 to 13% in 2023. Among those businesses impacted in 2025, over four in five (84%) of them did not make a ransom payment.

Chart 2 Methods most commonly used for cyber security incidents, Canada, 2021 to 2025

Majority of businesses in Canada are using cyber security prevention measures

In 2025, most (86%) businesses in Canada were using some sort of cyber security prevention measure. The most commonly used was email security (73%), followed by anti-malware software (69%) and network security (67%).

Just over 1 in 10 businesses (11%) used AI -based cyber security tools in 2025. Use of these technologies is most common among large businesses (46%).

Usage of cyber risk insurance continues to grow

In 2025, over one-third (34%) of businesses indicated having cyber risk insurance, a rate that has increased from 2023 (22%) and more than doubled from 2021 (16%). Large businesses (63%) were the most likely to report having this type of insurance. In 2025, 6% of businesses with cyber risk insurance that were impacted by a cyber security incident attempted to make a claim, a decrease from 9% in 2023, despite increased adoption rates of this type of insurance.

Businesses are also using several other cyber risk management arrangements. Having employees with responsibility for overseeing cyber risks and threats (46%) was the most commonly reported arrangement in 2025, followed by having backups of digital information (43%) or having a consultant or contractor that manages cyber risks and threats (38%). Businesses spent an average of $54,772 on all prevention measures in 2025, up from 2023 ($53,907). Spending in 2025 was most notably on employee salary related to cyber security ($17,103) and on cyber security software ($16,287).

Fewer respondents are reporting their cyber security incidents to police services

Just over 1 in 10 (11%) of businesses impacted by cyber security incidents reported them to police services in 2025, down slightly from 2023 (13%). Among businesses that did not report any incidents in 2025, the most common reason was that they were resolved internally (45%), while others considered the incidents too minor or not important enough to report (33%) or that there was no requirement for them to report (27%).

Digital economy and society statistics portal and publications

For more information on the digital economy and society, visit the Digital economy and society statistics portal and the Digital Insights publication, which bring together a variety of data from across Statistics Canada and other sources to provide statistics, analysis and interactive tools related to the digital economy and society in Canada.

Data for the 2025 Canadian Survey of Cyber Security and Cybercrime ( CSCSC ) were collected from January to March 2026. Respondents were asked to only report activities that occurred in 2025.

The target population of the 2025 CSCSC included enterprises with Canadian operations and 10 or more employees, across most economic sectors, except for public administration.

The business size categories presented in this release are based on the enterprise's number of employees:

Small businesses have 10 to 49 employees.

Medium-sized businesses have 50 to 249 employees.

Large businesses have 250 or more employees.

For more information on the survey's methodology, visit the CSCSC 's Integrated Metadata Database page.

For indicators related to cyber security incidents and their effects on business operations, businesses were only asked to report on incidents that impacted them. Therefore, incidents that businesses deemed not impactful are not captured in these indicators.

In past releases, comparisons were made with the United Kingdom's Cyber Security Breaches Survey due to its methodological similarity to the CSCSC . However, due to methodological changes to some questions starting in the 2024 release of the United Kingdom's survey, the trend of the key variable that was previously discussed is no longer comparable to the CSCSC .

The "Password cracking" category in chart 2 was given this wording in 2023. In survey iterations, the category was labelled "Hacking or password cracking." This change may have had a small impact on the observed trends in 2023 onwards.

Cost figures published for the 2017 CSCSC are not comparable with later iterations due to changes in the data imputation strategy and the aggregate calculation methodology.

For more information, or to enquire the concepts, methods or data quality of this release, us (toll-free 1-800-263-1136 ; 514-283-8300 ; [email protected] ) or Media Relations ( [email protected] ).