Cybercrime Statistics Canada [2026]

Police-reported cybercrime reached 225.1 incidents per 100,000 Canadians in 2024, more than double the rate of 91.9 in 2018, according to Statistics Canada 2025. Canadian businesses spent $1.2 billion recovering from cyber incidents in 2023, double what they spent in 2021. Data comes from Statistics Canada’s UCR series and CSCS survey, the CCCS NCTA 2025–2026, the CAFC, and the OPC. Coverage spans ransomware, phishing, data breaches, identity theft, and state-sponsored threats across Canada.

Headline numbers

Fraud was the most reported cyber-related violation in Canada in 2024, with 46,301 incidents — nearly half of all police-reported cybercrimes that year, according to Statistics Canada 2025. Combined fraud-related violations (fraud, identity theft, identity fraud, and extortion) accounted for 62% of all police-reported cybercrimes in 2024.

The 2024 police-reported rate of 225.1 per 100,000 actually fell 9% from the 2023 peak, though it remains more than double the 2018 baseline of 91.9. Businesses, meanwhile, absorbed sharply higher recovery costs: $1.2 billion in 2023, up from approximately $600 million in 2021. Fewer but more financially damaging incidents are occurring. Prevention and detection spending reached $11 billion in 2023. Employee salaries ($3.8 billion) and cyber software ($2.9 billion) were the largest categories, per Statistics Canada’s Canadian Survey of Cyber Security and Cybercrime.

Investment fraud, romance scams, and elder targeting sit in the broader fraud picture covered by the fraud statistics Canada cornerstone page.

What is cybercrime under Canadian law

Under Canadian law, “cybercrime” covers two distinct categories. Cyber-dependent offences are crimes that can only be committed using digital technology. Cyber-enabled offences are traditional crimes amplified by technology, such as fraud and identity theft. Statistics Canada classifies an incident as cybercrime when a computer or the internet was either the target of the crime or the instrument used to commit it. The full working definition appears in the agency’s Juristat article on cybercrime in Canada. This taxonomy has anchored CCCS and Statistics Canada reporting since at least 2018.

Three Criminal Code sections anchor most cybercrime prosecutions in Canada. Section 342.1 prohibits fraudulently obtaining computer services, intercepting computer functions, or trafficking in computer passwords without lawful authority. The maximum penalty is 10 years on indictment, per Department of Justice Canada. Section 430(1.1) targets mischief in relation to computer data: wilfully destroying, altering, or obstructing access. It carries the same 10-year indictable maximum under s.430(5), per Department of Justice Canada.

Section 184(1) prohibits intercepting private communications by any electro-magnetic, acoustic, mechanical, or other device. The maximum is five years on indictment, per Department of Justice Canada. Identity theft under s.402.2 is a separate offence. It covers obtaining or possessing another person’s identity information with intent to commit fraud or deceit, and also carries a five-year maximum, per Department of Justice Canada.

Ransomware attacks on Canadian businesses

Canadian ransomware incidents grew at an average of 26% per year from 2021 to 2024, according to the CCCS National Cyber Threat Assessment 2025–2026. Average ransom payments by Canadian organizations reached $1.13 million CAD in 2023, a 150% increase in two years. Globally, ransomware payments set a record of US$1 billion in 2023. The following incidents illustrate the trajectory of ransomware targeting in Canada, in chronological order:

1. SickKids Hospital (December 2022). A ransomware attack disrupted patient-care systems at The Hospital for Sick Children in Toronto. The CCCS NCTA 2025–2026 identifies this as part of a wave that drove a 75% increase in Canadian healthcare ransomware incidents between 2022 and 2023.

2. Five Southern Ontario hospitals (October 2023). A coordinated ransomware attack hit five hospitals in the Southwestern Ontario region simultaneously, forcing patient diversions and procedural delays. Healthcare’s 75% year-over-year increase between 2022 and 2023 is documented in the CCCS NCTA 2025–2026.

3. MOVEit supply-chain breach (June 2023). The Cl0p ransomware group exploited a zero-day in MOVEit Transfer software, compromising an estimated 2,750 enterprises and 94 million individuals globally. In Canada, the breach exposed data on 100,000 Nova Scotia government employees, per the CCCS NCTA 2025–2026.

4. CCCS pre-ransomware notifications (2024–2025). The CCCS Ransomware Threat Outlook 2025–2027 reports that 336 pre-ransomware notifications were issued to over 300 Canadian organizations in 2024–2025, with estimated economic savings of up to CAD $18 million.

Despite the scale of payments at the top end, 88% of Canadian business ransomware victims in 2023 did not pay the ransom, per Statistics Canada 2024. Of those who did pay, 84% paid under $10,000, but 4% paid over $500,000. Ransomware affected 13% of businesses that reported a cyber security incident in 2023, up from 11% in 2021. The CCCS Ransomware Threat Outlook 2025–2027 also identifies a strategic shift toward “exfiltration-only” attacks, where groups forgo encryption and extort victims through threatened data publication.

Phishing and business email compromise in Canada

• Spear phishing and business email compromise (BEC) accounted for $67.3 million in reported losses to the Canadian Anti-Fraud Centre 2024, the second-largest category of cybercrime losses after investment fraud.

• Phishing fraud increased 6.8% in victimization rate in 2024 compared to 2023, per the CAFC 2024 Annual Statistical Report.

• BEC scams most commonly impersonate government agencies (Canada Revenue Agency, Canada Post, and Amazon), per the CCCS Baseline Cyber Threat Assessment on Cybercrime.

• Threat actors are now using large language models (LLMs) to generate personalized phishing messages at scale and create deepfakes. Social engineering attacks against Canadian targets are getting harder to detect, per the CCCS NCTA 2025–2026.

• Publicly reported AI-generated harm incidents grew from 36 cases in 2022 to 107 in 2023, with 138 projected for 2024 based on first-half figures, per the CCCS NCTA 2025–2026.

• Scams and fraud affected 50% of Canadian businesses that reported a cyber security incident in 2023, up 6 percentage points from 2021, per Statistics Canada 2024.

Pig-butchering and investment-fraud phishing now share the same social-engineering playbook as cybercrime BEC. The romance scam statistics post tracks that convergence across Canada, the US, and the UK.

Data breaches and PIPEDA reporting

In fiscal 2023–2024, Canada’s Office of the Privacy Commissioner received 693 PIPEDA breach reports from private-sector organizations, affecting approximately 25 million Canadian accounts. That doubled the roughly 12 million affected in 2022–2023, per the OPC Annual Report 2023–2024. Cyberattacks (malware, compromised credentials, hacking, and phishing) accounted for 46% of all breach reports (321 incidents), a 13% increase from the prior year.

In fiscal 2024–2025, unauthorized access became the dominant breach type at 81% of all reported breaches, up from 66% in 2022–2023, per the OPC Annual Report 2024–2025. Financial services was the most breach-prone sector at 31% of reported breaches. Telecommunications accounted for 12%. The MOVEit supply-chain breach alone compromised an estimated 2,750 enterprises and 94 million individuals globally, with 100,000 Nova Scotia government employees affected in Canada.

Identity theft as cybercrime

• Police-reported identity fraud reached a rate of 50 incidents per 100,000 population in 2024, a 2% increase from 2023. A separate category, identity theft, held stable at 14 incidents per 100,000, per Statistics Canada 2025.

• Among Canadian businesses, the share reporting identity theft as a cybercrime type rose from 20% to 31% of all impacted businesses between 2021 and 2023, per Statistics Canada 2024. This represents a faster increase than most other cybercrime categories.

• An estimated 7.8% of Canadians aged 15 and older (approximately 2.5 million people) reported being a fraud victim in the 12 months preceding Statistics Canada’s 2019 General Social Survey. Only 11% of those victims reported the incident to police, per Statistics Canada 2023. The 2019 GSS remains the most recent self-reported individual victimization survey and should be treated as a historical baseline.

• Daily internet users are nearly three times more likely to experience fraud victimization than those who never use the internet (18% versus 6%), per the 2019 GSS. Digital connectivity amplifies exposure beyond simply being the means of attack.

• Large businesses (250+ employees) had the highest cybercrime impact rate at 30% in 2023, nearly double the national average of 16%. Small businesses had the lowest reporting rate to police at 12%, per Statistics Canada’s CSCS 2023.

Older Canadians absorb a disproportionate share of tech-impersonation phishing losses. CRA impersonation, tech-support scams, and the cognitive-vulnerability research live in the elder fraud statistics post.

State-sponsored and critical infrastructure threats

• The CCCS NCTA 2025–2026 assessed that PRC cyber actors compromised at least 20 networks associated with Government of Canada agencies and departments over a four-year period ending in 2024.

• Russian state-sponsored actors (tracked as Midnight Blizzard) compromised Microsoft enterprise email in January 2024, exfiltrating correspondence between Microsoft and Canadian, US, and UK government officials, per the CCCS NCTA 2025–2026.

• The CCCS identifies five state-sponsored threat actors targeting Canadian interests: the PRC, Russia, Iran, India, and North Korea (DPRK). DPRK actors conduct ransomware and cryptocurrency theft to generate regime revenue, described as a “persistent and well-resourced” threat to a broad range of Canadian industries.

• Iranian state cyber actors are assessed to monitor Canadian activists, journalists, and diaspora members through sophisticated social engineering campaigns. Iranian operations against Western targets increased markedly in 2023, with 8 distinct operations documented in October 2023 alone, per the CCCS NCTA 2025–2026.

• Three major cloud providers (Amazon, Microsoft, and Google) control 65% of the global cloud market, creating a systemic concentration risk. A compromise of any one provider could simultaneously affect thousands of Canadian organizations, per the CCCS NCTA 2025–2026.

State-actor operations frequently combine cyber intrusion with physical and electronic surveillance. Espionage and bug sweep services address the counter-surveillance and TSCM vectors that sit alongside the cyber threat picture.

Cybercrime trends: 2019 to 2024

Police-reported cybercrime in Canada more than doubled between 2018 and 2024, rising from 91.9 to 225.1 incidents per 100,000 population, according to Statistics Canada 2025. The rate peaked in 2023 before declining 9% in 2024. Since 2014, police-reported cyber-related crimes grew approximately 387% through 2022, per Statistics Canada’s UCR table 35-10-0002-01.

The business-impact picture tells a different story from the police-reporting trend. The share of businesses experiencing a cyber incident fell from 21% in 2019 to 18% in 2021 and 16% in 2023. Recovery costs simultaneously doubled to $1.2 billion over the same period. Fewer incidents occurred, but each one proved more damaging, per Statistics Canada 2024.

CAFC-reported fraud losses climbed steadily across the same window: $383 million in 2021, $530 million in 2022, $567 million in 2023, and $638 million in 2024. Source: CAFC 2024 Annual Statistical Report and the CCCS NCTA 2025–2026. Globally, median cyber intrusion detection time fell from 16 days in 2022 to 10 days in 2023, indicating improving detection capability, per the CCCS NCTA 2025–2026. Ransomware groups have simultaneously shifted toward exfiltration-only attacks, abandoning encryption in favour of data theft and extortion. The CCCS Ransomware Threat Outlook 2025–2027 cites the Hunters International rebrand to World Leaks in January 2025 as a marker of this shift.

Cybercrime by province and city size

British Columbia had the highest provincial police-reported cybercrime rate in 2024 at 423.0 incidents per 100,000 population, while Nunavut had the lowest at 114.2, according to Statistics Canada 2025. Cybercrime is more prevalent in larger Canadian cities than in smaller towns. The rate was 237.7 per 100,000 in Canada’s largest cities versus 186.8 per 100,000 in smaller towns in 2024, per the same Statistics Canada feature article.

In the first half of 2025, police across Canada reported 40,437 cybercrime incidents, per Statistics Canada preliminary data. That pace suggests the full-year 2025 total may approach or exceed 2024’s count. Alberta’s self-reported fraud victimization rate reached 22% over a five-year period (the highest of any province), versus 13–14% in Atlantic provinces, per Statistics Canada’s 2019 General Social Survey. These self-reported figures use 2019 data, the most recent provincial self-report cycle available, and should be treated as directional indicators rather than current-year counts.

Large businesses in Canada absorbed the highest cyber impact. 30% of businesses with 250+ employees reported a cyber security incident in 2023. That figure is nearly double the national average of 16%, per Statistics Canada’s CSCS 2023. That differential holds implications for corporate investigations work. Larger organizations face a higher incident probability, and when breaches occur, recovery costs run significantly higher.

Methodology — what the numbers count and what they don’t

Canada has four distinct national-level data collection streams for cybercrime. Each measures a different population and captures different incident types. No single dataset provides a complete national picture.

Statistics Canada’s Uniform Crime Reporting (UCR) Survey counts only incidents reported to police. The 225.1-per-100,000 rate cited throughout this page is a UCR figure. It reflects what police services entered into the national reporting system, not total incidents. Statistics Canada’s business survey found only 13% of business victims reported incidents to police in 2023, per Statistics Canada 2024. The true incident volume is a multiple of police-reported figures.

The Canadian Survey of Cyber Security and Cybercrime (CSCS) surveys businesses directly and captures the 16%-impacted-businesses figure and the $1.2-billion recovery cost. It does not survey individuals; it covers only businesses with employees. Individual cybercrime losses, beyond what the CAFC documents, are not systematically tracked at the national level through this instrument, per the CSCS survey overview.

The Canadian Anti-Fraud Centre (CAFC) tracks consumer complaints submitted voluntarily to its national repository. The CAFC estimates that only 5–10% of fraud and cybercrime victims report to CAFC. The $638 million in documented 2024 losses likely represents one-tenth to one-fifth of actual Canadian losses, per the CAFC 2024 Annual Statistical Report.

The OPC PIPEDA breach notification system records mandatory breach reports from private-sector organizations. It captures events affecting personal information (which includes many cyberattacks), but is limited to businesses subject to PIPEDA. It excludes public-sector organizations regulated by the Privacy Act.

Statistics Canada also introduced enhanced cybercrime variables into the UCR Survey in 2021 (UCR version 2.4), per Statistics Canada UCR methodology. Data before and after 2021 are only partially comparable. Earlier figures (2014–2020) should be treated as directional trends rather than precise baselines.

What these numbers mean for Canadian businesses and individuals

The $638 million in CAFC-documented losses is a floor, not a ceiling. At the CAFC’s own estimated 5–10% reporting rate, actual Canadian cybercrime losses in 2024 are plausibly $6–12 billion annually. Only 26% of Canadian businesses maintained written cyber security policies in 2023 and only 22% provided formal employee training. Both figures have barely moved since 2021, per Statistics Canada 2024. Cyber risk insurance adoption doubled from 16% to 22% between 2021 and 2023, but 78% of businesses remain uninsured.

Daily internet users face nearly three times the fraud victimization risk of those who never go online (18% versus 6% per the 2019 GSS). The average individual victim lost $15,028 in 2024, per the CAFC 2024 Annual Statistical Report. Account records, IP logs, and device identifiers form the attribution chain. Social media and internet investigation services preserve and authenticate that chain so law enforcement and civil counsel have a workable evidence base.

As licensed PIs in Canada, we see these patterns at the point where a cyber incident has crossed into fraud, identity theft, or corporate espionage. Typically, the victim has already discovered the breach but hasn’t yet established what was taken or who was responsible. The CCCS data confirms what client engagements show: BEC and AI-generated phishing are the entry vectors for most corporate cases, while identity theft and social engineering fuel the individual cases. Investment fraud and mortgage fraud vectors form the broader financial fraud picture covered in the fraud statistics Canada cornerstone, alongside other research in the fraud pillar.