How many Quebec small businesses get hit by a cyberattack? According to a KPMG survey released in October 2023, 63% of the 154 Quebec SMBs surveyed had been attacked by cybercriminals in the past year. Nationally, Statistics Canada estimates that about 1 in 6 businesses (16%) were impacted by a cyber security incident in 2023.
Samples and definitions differ from one source to the next, so read the methodology before comparing figures.
TL;DR
- 63% of Quebec SMBs surveyed by KPMG in 2023 had been attacked in the past year.
- The CAI received 518 confidentiality incident notices from January 1 to December 10, 2025; as of January 9, 2026, it had imposed no administrative monetary penalty.
- The Canadian Anti-Fraud Centre recorded over $704 million in reported fraud losses in 2025 (CAFC, 2026), yet it estimates only 5-10% of victims report (CAFC, 2025).
- According to CDW (2025), small Canadian organizations take an average of 6.8 days to detect an incident and 25.7 days to recover.
- According to Statistics Canada, business spending on incident recovery doubled to $1.2 billion in 2023.
Cyberattacks on small businesses
According to Statistics Canada, 16% of Canadian businesses with 10 or more employees were impacted by a cyber security incident in 2023. Private surveys, using different methods, report higher rates.
| Statistic | Value | Source |
|---|---|---|
| Canadian businesses (10+ employees) impacted by a cyber security incident | 16% in 2023 (18% in 2021, 21% in 2019) | Statistics Canada, 2024 |
| Impacted businesses that reported ransomware | 13% in 2023 (11% in 2021) | Statistics Canada, 2024 |
| Quebec SMBs attacked by cybercriminals in the past year | 63% (154 SMBs surveyed) | KPMG, 2023 |
| Quebec SMBs without skilled personnel to implement cybersecurity or monitor for attacks | 65% | KPMG, 2023 |
| Quebec SMBs without a plan to address a ransomware attack | 58% | KPMG, 2023 |
| Canadian small businesses that experienced a cyberattack in the last five years | 86% | Coalition, 2025 |
| Canadian small businesses that believe they are too small to be targeted | 77% | Coalition, 2025 |
| Canadian small business owners who had already experienced an attack | 53% | Zensurance, 2025 |
| Average annual growth in ransomware incidents known to the Cyber Centre, since 2021 | 26% (2024 projected) | Canadian Centre for Cyber Security, 2024 |
Note that KPMG's 2023 survey excluded companies with less than $10 million in annual revenue, so it leaves out the smallest businesses.
Costs
According to Statistics Canada, Canadian businesses spent about $1.2 billion recovering from cyber security incidents in 2023, double the 2021 amount.
| Statistic | Value | Source |
|---|---|---|
| Recovery spending (businesses with 10+ employees) | about $1.2 billion in 2023 (about $600 million in 2021) | Statistics Canada, 2024 |
| Recovery spending by small businesses (10 to 49 employees) | about $300 million in 2023 | Statistics Canada, 2024 |
| Prevention and detection spending | $11.0 billion in 2023, including $2.6 billion by small businesses | Statistics Canada, 2024 |
| Average losses by incident type | phishing: $89,000; funds transfer fraud: $118,000; data breach: $220,000; ransomware: $330,000 | Insurance Business Canada (article on Zensurance), 2025 |
| Windows 10 Extended Security Updates (ESU) for organizations | US$61 per device for year one, price doubling each year (three years maximum) | Microsoft, 2025 |
The average losses by incident type are "industry data" with no named primary source (Insurance Business Canada, October 2025): treat them as orders of magnitude, for example when building a small business cybersecurity budget.
Reported incidents and legal framework (Quebec)
According to its 2024-2025 annual report, the CAI received 514 confidentiality incident notices between April 1, 2024 and March 31, 2025, up 16% year over year.
| Statistic | Value | Source |
|---|---|---|
| Incident notices received by the CAI, 2024-2025 fiscal year | 514 (+16% year over year), 80% from the private sector | CAI, 2025 |
| Growth in notices received over three years | 559% | CAI, 2025 |
| Most cited causes in 2024-2025 (a notice can cite several) | cyberattack (160), human error (110), ransomware (106), phishing (48) | CAI, 2025 |
| Sectors that filed the most notices in 2024-2025 | health care and social assistance (94), finance and insurance (89), professional, scientific and technical services (61) | CAI, 2025 |
| Notices received from January 1 to December 10, 2025 | 518 | CAI, 2026 |
| Administrative monetary penalties or penalties imposed by the CAI | none as of January 9, 2026 | CAI, 2026 |
| Deadline to notify the CAI of an incident with a risk of serious injury | no fixed deadline: "promptly" (s. 3.5) | Law 25 (LegisQuébec) |
| Maximum administrative monetary penalty (business) | $10 million or 2% of worldwide turnover, if higher (s. 90.12) | Law 25 (LegisQuébec) |
| Penal fine (business) | $15,000 to $25 million, or 4% of worldwide turnover if higher (s. 91) | Law 25 (LegisQuébec) |
| Punitive damages (intentional infringement or gross fault) | at least $1,000 (s. 93.1) | Law 25 (LegisQuébec) |
| Bill C-8, Critical Cyber Systems Protection Act (federal): maximum penalty | $15 million per violation, per day (organization); $500,000 (individual) | BLG, 2025 (updated 2026) |
The CAI announced on May 27, 2025 that it would stop publishing the list of organizations that report incidents, but not its statistics (Gowling WLG, 2025). See how to report a confidentiality incident to the CAI.
Bill C-8 received Royal Assent on June 15, 2026 (LEGISinfo); its Part 2, which covers designated operators in finance, telecommunications, energy and transportation, will be implemented gradually (Public Safety Canada, 2026). These amounts are maximums: confirm your situation with your legal counsel or our Law 25 compliance service.
Fraud (Canada)
According to the Canadian Anti-Fraud Centre (CAFC), it received over 112,000 fraud reports involving over $704 million in reported losses in 2025.
| Statistic | Value | Source |
|---|---|---|
| Fraud reports received by the CAFC | over 112,000 in 2025 | CAFC, 2026 |
| Losses reported to the CAFC | over $704 million in 2025 | CAFC, 2026 |
| Reported spear phishing losses (second costliest fraud type) | $67.9 million in 2025 (813 reports, 571 victims) | CAFC, 2026 |
| Spear phishing losses, January to March 2026 | nearly $31 million | CAFC, 2026 |
| Victims who report fraud to the CAFC | 5-10% (estimate) | CAFC, 2025 |
| Impacted businesses whose incidents involved scams and fraud | 50% in 2023 | Statistics Canada, 2024 |
| Impacted businesses that reported incidents to police | 13% in 2023 (10% in 2021) | Statistics Canada, 2024 |
The CAFC groups under spear phishing the frauds that impersonate a business executive, a supplier or a contractor, such as CEO fraud. Its figures cover individuals and businesses alike.
Detection and recovery times
According to CDW's 2025 Canadian study, small Canadian organizations took an average of 6.8 days to detect an incident in 2025, up from 4.0 days in 2024.
| Statistic | Value | Source |
|---|---|---|
| Average detection time (small organizations) | 6.8 days in 2025 (4.0 days in 2024) | CDW, 2025 |
| Average incident response time | 13.3 days (up from 10.9 days) | CDW, 2025 |
| Average recovery time | 25.7 days | CDW, 2025 |
Our anatomy of a ransomware attack shows what happens during those weeks.
Quebec's small business landscape
According to Statistics Canada (June 2022 data compiled by CFIB in 2023), Quebec had 274,296 businesses with employees, 53% of which had 1 to 4 employees.
| Statistic | Value | Source |
|---|---|---|
| Businesses with employees in Quebec | 274,296 (June 2022) | Statistics Canada, via CFIB, 2023 |
| Share with 1 to 4 employees | 53% | Statistics Canada, via CFIB, 2023 |
| Share with fewer than 100 employees | over 98% | Statistics Canada, via CFIB, 2023 |
| Jobs in Quebec SMBs | about 2.35 million, or 68% of the private-sector workforce | CFIB, 2023 |
The term "SMB" can therefore cover both a four-person accounting firm in the West Island and a company with $300 million in revenue, like some in KPMG's 2023 survey.
Methodology
We gave priority to official sources, supplemented by surveys from consulting firms, insurers and IT vendors. Every figure was rechecked against its source; figures we could not confirm were removed, and none was rounded beyond the source.
- Commercial interests. Coalition and Zensurance sell cyber insurance, CDW sells IT products and services, and KPMG sells consulting services.
- Samples. Statistics Canada: 12,462 businesses with 10 or more employees (2023). KPMG: 154 Quebec SMBs with $10 million or more in revenue (August-September 2023). Coalition: 1,000 small businesses in five countries (2025). Zensurance: 1,000 Canadian small business owners (September 2025). CDW does not publish its sample or its definition of a "small organization."
- Revisions. CAFC losses change as reports come in: 2025 spear phishing stands at $67.9 million in the annual summary and at "in excess of $68 million" in May 2026.
- Currency. Canadian dollars unless otherwise noted.
Last checked: October 2026.
How to cite this page
Cite the primary source, and this page as the compilation:
Source: "Cybersecurity Statistics for Quebec and Canada (2026)," October 2026.
Add the link and the date you accessed it. To see where your own business stands, request a quote.
Frequently asked questions
How many small businesses in Quebec are hit by cyberattacks?+
According to a KPMG survey released in October 2023, 63% of the 154 Quebec SMBs surveyed had been attacked by cybercriminals in the previous year; the survey excluded companies with less than $10 million in annual revenue. Nationally, Statistics Canada estimates that 16% of businesses with 10 or more employees were impacted by a cyber security incident in 2023. The two figures rest on different definitions and samples.
How many privacy incidents are reported to the CAI each year?+
According to its 2024-2025 annual report, Quebec's Commission d'accès à l'information received 514 confidentiality incident notices between April 1, 2024 and March 31, 2025, up 16% from the previous year. In a response dated January 9, 2026, it said it had received 518 notices between January 1 and December 10, 2025. Only incidents that present a risk of serious injury must be reported to it.
How much does a cyberattack cost a small business in Canada?+
Industry data cited by Insurance Business Canada in October 2025 puts average losses at $89,000 per phishing incident, $118,000 per funds transfer fraud and $330,000 per ransomware attack. The primary source of these averages is not named, and real costs vary widely. According to Statistics Canada, small businesses with 10 to 49 employees spent about $300 million in total recovering from incidents in 2023.
Has the CAI fined any company under Law 25?+
In a response to an access request dated January 9, 2026, the CAI stated that no administrative monetary penalty or penalty had been imposed by the Commission as of that date. Law 25 nonetheless allows administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%. Check the CAI website for more recent decisions.
Sources
- 1.Statistics Canada — Impact of cybercrime on Canadian businesses, 2023 (The Daily, October 21, 2024)
- 2.KPMG (via Newswire) — Cybercrime strikes more than six in 10 Quebec small- and medium-sized businesses in the past year (October 24, 2023)
- 3.Canadian Underwriter — Canadian small businesses underestimate cyber risk, study finds (Coalition, July 2025)
- 4.Zensurance — 7 Cyber Insurance Claims We Saw in 2025 (September 2025 survey)
- 5.Insurance Business Canada — AI-powered attacks push cyber risks higher for Canada's SMEs: Zensurance (October 2025)
- 6.Canadian Centre for Cyber Security — National Cyber Threat Assessment 2025-2026
- 7.Commission d'accès à l'information — 2024-2025 annual activity and management report (October 2025, French)
- 8.Commission d'accès à l'information — Decision AI-2526-238 (January 9, 2026, French)
- 9.Gowling WLG — Québec Access to Information Commission to stop publishing list of privacy incident reports (May 2025)
- 10.Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 3.5, 90.12, 91 and 93.1
- 11.LEGISinfo — Bill C-8 (45th Parliament, 1st session)
- 12.Public Safety Canada — Royal Assent of Bill C-8 (June 16, 2026)
- 13.BLG — Bill C-8 revives Canadian cyber security reform (2025, updated 2026)
- 14.Canadian Anti-Fraud Centre — Fraud Prevention Month 2026
- 15.Canadian Anti-Fraud Centre — Canadian Anti-Fraud Centre and partners assist in $3.5M recovery linked to sophisticated payment redirection fraud (May 13, 2026)
- 16.Canadian Anti-Fraud Centre — International collaboration successfully intercepts and returns $2.3 million fraudulent transfer (July 24, 2025)
- 17.Canadian Anti-Fraud Centre — Frauds affecting businesses
- 18.CDW Canada — IT and Cybersecurity Trends for Small Businesses in Canada (2025 Canadian Cybersecurity Study)
- 19.Microsoft — Extended Security Updates (ESU) program for Windows 10
- 20.CFIB — Québec et Ontario : un couloir économique à exploiter pour l'économie et les PME (July 2023, French)