New data · Statistics Canada

Small businesses are hit too: 15% were in 2025

15% of Canadian businesses with 10 to 49 employees were impacted by a cyber incident in 2025. The gap with large businesses has been shrinking since 2019, mostly because a smaller share of large ones were impacted.

The data

Businesses impacted by a cyber incident in 2025, by size
Business sizeShare (%)Note
Small (10 to 49)1510 to 49 employees. Up from 14% in 2023, down from 18% in 2019.
Medium (50 to 249)2150 to 249 employees. Across all sizes, about one in six (16%) businesses were impacted in 2025.
Large (250 or more)25250 or more employees: still the most likely to be hit, but the gap has been shrinking since 2019.

Businesses with 10 or more employees, excluding public administration. Organizations with fewer than 10 employees are not in the survey, and the release gives no separate figures for clinics, primary care networks (PCNs) or nonprofits. Large businesses: 44% in 2019, 25% in 2025.

Adapted from Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2025 (released Oct. 21, 2026). This does not constitute an endorsement by Statistics Canada of this product.

Three steps for a small clinic this month

  1. Turn on multi-factor authentication. On every account that can reach patient information.
  2. Run a restore test of the backup. Restore a copy of the records system backup to a safe test location, never over the live records, and write down who can do it.
  3. Know who the custodian is. Under Alberta's Health Information Act, the custodian (physicians and registered nurses are examples) must assess whether a breach creates a risk of harm and, if it does, give written notice as soon as practicable to the people affected, the Information and Privacy Commissioner and the Minister of Primary and Preventative Health Services.

For a small clinic, in short

  • Turn on multi-factor authentication for every account with patient data
  • Test the records backup; name who can restore it
  • In Alberta, the custodian must assess the risk of harm after a breach, and give notice if there is one

Sources

All explainers