Data Breach Statistics Canada [2026]

Canada’s Office of the Privacy Commissioner received 686 mandatory breach reports under PIPEDA in fiscal 2024–25, affecting approximately 20 million Canadians, per the OPC’s 2024–2025 Annual Report. Statistics Canada 2024 found Canadian businesses spent $1.2 billion recovering from cyber incidents in 2023, double the 2021 total. This post covers breach volumes, sector breakdowns, cost data, and PIPEDA reporting rules. The fraud statistics Canada pillar hub indexes the full research series.

What counts as a data breach in Canada

Under PIPEDA, a “breach of security safeguards” is the loss of, unauthorized access to, or unauthorized disclosure of personal information due to a failure of an organization’s security measures. Deliberate cyberattacks and accidental exposures both qualify — misdirected emails, lost laptops, and misconfigured cloud storage are all covered, per OPC guidance 2018.

Not every breach triggers mandatory reporting. PIPEDA’s Real Risk of Significant Harm (RROSH) test governs which breaches must be escalated. An organization must report when it is reasonable to believe the breach creates a real risk of significant harm to an affected individual. Under PIPEDA, s. 10.1, significant harm is defined in statute to include financial loss, identity theft, damage to reputation, and loss of employment opportunities. The test weighs both the sensitivity of the exposed data and the probability it will be misused.

Two factors make this definition broader than it first appears. First, “unauthorized access” reaches insider threats: a rogue employee browsing records without a business purpose qualifies. Second, the safeguards failure can be proactive — if an organization never established adequate protections, a resulting exposure still meets the definition. The cybercrime statistics Canada post documents how ransomware and credential-stuffing attacks (the dominant vectors behind PIPEDA reports) exploit exactly these gaps.

How many data breaches are reported in Canada each year

Annual PIPEDA breach-report volumes have stabilized since mandatory reporting came into force in November 2018. The table below covers the four most recent fiscal years, with the first mandatory-reporting year shown for comparison.

Sources: OPC Annual Report 2024–2025; OPC Annual Report 2023–2024; OPC 2019 retrospective.

The individual-impact figures reveal how a single large incident distorts annual totals. In 2023–24, 693 reports covered approximately 25 million accounts — more than twice the 12 million affected in 2022–23, even though incident counts barely changed.

Cyberattacks drove 81% of the 686 PIPEDA breach reports in 2024–25, classified as unauthorized access. The remaining reports broke down as unauthorized disclosures (13%), loss of records (3%), and theft of devices (3%), per the OPC 2024–2025 Annual Report. Phishing, credential stuffing, and ransomware account for the bulk of the unauthorized-access category.

When PIPEDA mandatory reporting launched in November 2018, the OPC received 680 reports in its first twelve months. That figure was six times the voluntary-era volume, with over 28 million Canadians affected. The Desjardins and Capital One breaches of 2019 drove much of that count. Annual volumes have since held between 640 and 700, pointing to a stable equilibrium in mandatory-reporting culture.

The cost of a data breach in Canada

Source: Statistics Canada 2024; Canadian Centre for Cyber Security 2025; CCCS Ransomware Threat Outlook 2025.

The $1.2 billion recovery figure is itself double the 2021 total. It reflects direct remediation: forensic investigation, system restoration, credit monitoring, legal fees, and regulatory compliance costs. Opportunity costs, reputational damage, and the downstream fraud enabled by stolen credentials are excluded.

Ransomware imposed especially steep costs. CCCS 2025 reports that Canadian ransomware incidents grew at an average of 26% year over year between 2021 and 2024. Information technology sector incidents surged 159% between 2022 and 2023 alone; finance sector incidents rose 157% over the same period. Among businesses that paid a ransom, the average payment reached $1.13 million CAD — a 150% increase over two years. Despite that, Statistics Canada 2024 found 88% of ransomware-hit Canadian businesses did not pay.

The CCCS Ransomware Threat Outlook 2025–2027 documents a direct counterweight. During 2024–25, the agency issued 336 pre-ransomware notifications to more than 300 Canadian organizations. Early warnings allowed those businesses to interrupt attacks before data was encrypted or exfiltrated, generating estimated savings of up to CAD $18 million.

Which sectors are breached most often

Financial services filed the largest share of PIPEDA breach reports in 2024–25. The table below shows sector share across three fiscal years, illustrating the consistency of the top-two rankings.

Sources: OPC Annual Report 2024–2025; OPC Annual Report 2023–2024.

Financial services dominates because of what it holds: payment card data, social insurance numbers, account credentials, and transaction histories — all high-value to fraudsters. The sector also has strong PIPEDA compliance culture relative to other industries, which may mean its high report share partly reflects better detection and filing, not just higher victimization.

Business size tracks exposure rates closely. Statistics Canada 2024 found 30% of large Canadian businesses (250 or more employees) reported a cyber security incident in 2023 — nearly double the national average of 16% across all business sizes. Large businesses absorbed approximately $500 million of Canada’s $1.2 billion total recovery spending.

Identity theft stands out as the fastest-growing attack vector tracked in the survey. Statistics Canada 2024 found identity theft was reported by 31% of businesses that experienced a cyber incident in 2023, up 11 percentage points from 2021. For deeper analysis of how stolen credentials drive downstream fraud, the identity theft statistics Canada post covers the full victim-count and loss series.

How Canada compares to other countries

The table below compares Canadian and US breach-scale indicators using the most recent available data from each country’s primary reporting body.

Sources: OPC Annual Report 2024–2025; Canadian Anti-Fraud Centre 2025; FBI IC3 2024 Annual Report; CCCS NCTA 2025–26.

The US complaint count dwarfs Canada’s PIPEDA report total, but the two systems measure different things. The IC3 accepts self-reported complaints from individuals and businesses; PIPEDA mandatory reports cover only private-sector organizations filing after a qualifying breach determination. Canada’s true breach incidence (including unreported incidents and public-sector events) is far larger than the 686-report figure implies.

The CAFC reported Canadian fraud losses of $643.7 million in 2024 across 108,878 complaints — a 290% increase from $165 million in 2020, per the Canadian Anti-Fraud Centre 2025. Cyber-enabled fraud, fed directly by stolen credentials from data breaches, drove 75% ($481.6 million) of those losses. The CAFC estimates only 5 to 10% of fraud incidents are ever reported — meaning actual losses could exceed $6 billion annually.

Globally, ransomware payments reached a record $1 billion USD in 2023, with a 74% increase in global ransomware incidents compared to 2022, per CCCS 2025. Canada’s 26% average annual growth rate between 2021 and 2024 tracks closely with that global surge. Phishing is the primary vector behind credential theft. The phishing statistics Canada post documents CAFC-reported volumes and business-email-compromise losses in detail.

Who must report under PIPEDA — and who is exempt

PIPEDA’s mandatory breach-reporting obligations apply broadly, with specific carve-outs:

• In scope — federal jurisdiction: All private-sector organizations operating under federal jurisdiction, including banks, airlines, telecommunications carriers, broadcasters, and interprovincial transportation companies, must comply with PIPEDA regardless of province.
• In scope — interprovincial activity: Any organization handling personal information across provincial or international borders is subject to PIPEDA for those transactions. This applies even if the organization’s primary operations are confined to one province.
• Three-province exemption: British Columbia, Alberta, and Quebec have enacted private-sector privacy laws deemed “substantially similar” to PIPEDA by the Governor in Council. Organizations in those provinces operating solely within provincial borders are generally exempt from Part 1 of PIPEDA for intra-provincial activities, per OPC provincial guidance 2024.
• What organizations must do: Under PIPEDA, s. 10.1, any organization that determines a breach creates a real risk of significant harm must (1) report to the Privacy Commissioner of Canada, (2) notify affected individuals, and (3) keep records of all breaches — including those that do not meet the RROSH threshold.
• Report content required: The Breach of Security Safeguards Regulations, SOR/2018-64 require breach reports to include the circumstances and cause (if known), the approximate period of the breach, a description of the personal information involved, the estimated number of individuals affected, risk-reduction steps taken, planned notifications, and a contact person for OPC inquiries.
• Timing: PIPEDA does not set a specific number of hours. The statute requires reporting “as soon as feasible” after the organization determines the breach has occurred. No 72-hour rule exists under Canadian law — that deadline applies under the UK’s GDPR. The OPC has recommended a 7-day requirement if Parliament modernizes PIPEDA through Bill C-27, but that bill had not received Royal Assent as of mid-2026.
• Exempt categories: Federal government institutions file breach reports under the Privacy Act, not PIPEDA. Employees’ personal information handled within federally regulated workplaces is partially exempt. Non-commercial activities by organizations are outside PIPEDA’s scope.

What data breaches mean for Canadians — and for businesses that investigate them

Stolen credentials from breaches do not stay dormant. Canadian fraud losses surged from $165 million in 2020 to $643.7 million in 2024 (a 290% increase in four years), with cyber-enabled fraud driving 75% of all reported losses, per the Canadian Anti-Fraud Centre 2025.

The 23andMe case illustrates the regulatory consequence of inadequate safeguards. A joint OPC and UK Information Commissioner investigation found 23andMe violated PIPEDA’s safeguards principle (Principle 4.7) by making multi-factor authentication optional. The company also violated section 10.1 by delaying notification to approximately 319,000 affected Canadians by over one month, per OPC Findings 2025-001. The breach arose from credential-stuffing attacks that recycled passwords exposed in earlier incidents.

Police reporting of corporate breaches remains rare. Only 13% of Canadian businesses impacted by cyber security incidents reported those incidents to police in 2023, up slightly from 10% in 2021, per Statistics Canada 2024. The low rate means most corporate data breaches never enter the criminal justice pipeline, leaving affected individuals without formal recourse and complicating attribution and prosecution.

What the data means for Canadians and the businesses that investigate breaches:

• Stolen credentials fuel downstream fraud. Canadian fraud losses rose from $165 million in 2020 to $643.7 million in 2024 (a 290% increase), with cyber-enabled fraud driving 75% of reported losses, per CAFC 2025.
• Weak safeguards carry regulatory consequences. The OPC found 23andMe violated PIPEDA by making multi-factor authentication optional and delaying notice to roughly 319,000 Canadians by over a month, per OPC Findings 2025-001.
• Most corporate breaches never reach police. Only 13% of affected Canadian businesses reported cyber incidents to police in 2023, per Statistics Canada 2024.
• Post-breach, the evidentiary trail matters. OPC breach-report records combined with CAFC victim-report data support civil litigation and corporate security audits.

As licensed PIs, we are retained after data breaches to trace how stolen credentials are being used — identity fraud, unauthorized account access, and social engineering attacks on colleagues. OPC breach-report records, combined with CAFC victim-report data, provide the evidentiary trail that supports civil litigation and corporate security audits. For businesses assessing exposure, corporate investigations and social media and internet investigations are the two service tracks most relevant to post-breach digital evidence work.