Canadian Cybersecurity News
Breaches, scams, regulatory changes, and security alerts affecting Canadian small and medium businesses.
Cybersecurity Canada covers data breaches, phishing scams, ransomware incidents, regulatory updates, and security alerts relevant to Canadian organizations. We publish new articles weekly and update older posts when facts change. Each article explains what happened, who is affected, and what your business should do.
Start with the free cybersecurity assessment to see where your organization stands. For background, read the Cybersecurity Canada Report 2026, our guide to cybersecurity laws in Canada, or how to report a cyber attack in Canada.
Penetration Testing Canada for SMBs
A penetration test validates whether vulnerabilities can be exploited. Here is what Canadian small businesses should ask before hiring a tester.
Read more
PCI DSS for Small Business in Canada
PCI DSS is a contractual requirement from card brands, not a Canadian law. Here is what merchants who accept card payments need to know about complian...
Read more
Cybersecurity for Accounting Firms
Cybersecurity for accounting firms in Canada starts with PIPEDA safeguards and CCCS baseline controls. What the law requires and which controls come f...
Read more
Canadian Time Zone Changes: IT Checks
Canadian time zone changes left BC, Alberta, Manitoba and parts of NWT and Ontario on new offsets Nov. 1, 2026. What small business IT should check.
Read more
Cybersecurity for Healthcare Clinics in Canada
Ontario health custodians reported 12,075 privacy breaches in 2025. Here is what Canadian clinics need to know about protecting patient data.
Read more
Cybersecurity for Law Firms in Canada: A Guide
Canadian law societies require lawyers to understand technology risks and protect confidential information. Here is what law firms need to know.
Read more
Microsoft 365 Security for Canadian Small Businesses
Security Defaults stops over 99.9% of common identity attacks at no extra cost. Here are the Microsoft 365 settings Canadian SMBs should configure fir...
Read more
Employee Offboarding Security Checklist for Canada
Revoke access the same day an employee departs. Only 70% of Canadian organizations have formalized offboarding procedures. Here is a security checklis...
Read more
Cybersecurity Policy for Small Business Canada: A Guide
In 2023, only 26% of Canadian businesses had written cybersecurity policies. Here is what PIPEDA and the CCCS baseline controls require.
Read more
Canadian Data Residency: What Small Businesses Need to Know
PIPEDA does not require Canadian data residency, but Quebec Law 25 and public sector contracts may. Here is what to ask vendors.
Read more
Business Continuity Plan Canada: A Guide for Small Business
A business continuity plan helps Canadian small businesses resume critical operations after a cyber attack or disaster. Here is how to build one.
Read more
Cyber Security Audit Canada: Which Service You Need First
A cyber security audit verifies compliance with a standard. An assessment identifies gaps first. Here is which one Canadian small businesses need.
Read more
DMARC for Canadian Businesses: Stop Email Spoofing
SPF, DKIM and DMARC prevent attackers from impersonating your domain in invoice and payment fraud. Google, Yahoo and Microsoft now require them for bu...
Read more
National Cyber Threat Assessment 2025-2026: What Canadian Small Businesses Need to Know
The National Cyber Threat Assessment 2025-2026 from the Canadian Centre for Cyber Security names ransomware as the top cybercrime threat to Canada. He...
Read more
Node.js Security Patch for Brotli Vulnerability: What Canadian Businesses Should Do
A critical Brotli decoder flaw (CVE-2026-111497) in Node.js allows remote code execution. Update to 22.23.4, 24.22.1, or 26.12.1 now.
Read more
Third-Party Vendor Data Breach: Lessons from the Crime Stoppers Hack
A third-party vendor data breach exposed 1.5 million Crime Stoppers tips in Canada, including personal information. Here is what SMBs should learn abo...
Read more
PHP2Shell Vulnerability: Why Canadian Businesses Should Rethink Self-Managed PHP Hosting
Two critical PHP remote code execution flaws rated CVSS 9.2 could affect every PHP version since PHP 5, and fixed versions are now out. For Canadian S...
Read more
WestJet Data Breach: The OPC Compliance Letter as a Security Checklist
On October 14, 2026, the Privacy Commissioner closed the WestJet data breach investigation after the airline met its compliance letter commitments. It...
Read more
CCQ Cyberattack: Why Only 10% Have Activated Their Free Protection
The CCQ cyberattack may affect 685,000 people, but only 10% have activated the free credit monitoring. When your workers receive a breach letter, here...
Read more
Save-On-Foods Data Breach: Why Canadian Businesses Should Rethink Customer Data Collection
The Save-On-Foods More Rewards breach exposed names, addresses, phone numbers, emails, and dates of birth. No passwords or credit cards, yet the risk...
Read more
CIBC Data Breach 2026: What Canadians Actually Need to Know
No confirmed 2026 CIBC data breach exists. But CIBC impersonation scams have surged in 2026, with bank investigator fraud costing Canadians CA$28.6M i...
Read more
AdFection Spyware Ads: What Canadian Businesses Should Know About Discover-Tech
Citizen Lab and Confiant revealed on October 15, 2026, that Israel-based Discover-Tech used targeted online ads to deliver zero-click mercenary spywar...
Read more
Burnaby School District Ransomware Attack Exposes Student and Staff Data: Lessons for Canadian Organizations
A ransomware attack on Burnaby School District discovered September 21, 2026 led to theft of student medical records, family registration documents, a...
Read more
Saskatoon Tribal Council Cyber Incident: Lessons for Canadian Organizations Holding Sensitive Data
The Saskatoon Tribal Council disclosed a cybersecurity incident on October 13, 2026, involving government IDs, health information, and child and famil...
Read more
Loblaw Data Breach Notification Email: Real or Scam?
Is the loblaws@notifications.cyberscout.com email real? Loblaw confirmed Cyberscout sends official breach notices. Learn how to tell real from fake.
Read more
Cyber Attack Readiness Self-Check: 10 Signs Your Canadian Small Business Is Prepared
Most Canadian small businesses cannot answer 'Are we ready for a cyber attack?' Here are 10 concrete signs that indicate readiness, drawn from the CCC...
Read more
Cybersecurity Grants and Funding for Canadian Small Businesses (2026)
There is no single federal cybersecurity grant in Canada. Here are the programs actually available in 2026: NRC IRAP support, Ontario's Cyber Integrat...
Read more
AA26-281A: China-Linked Hackers Are Exploiting Flaws Up to 12 Years Old
Joint advisory AA26-281A, co-authored by Canada's Cyber Centre on October 8, 2026, lists eight flaws China-linked hackers exploited. The oldest dates...
Read more
A Canadian Ransomware Negotiator Was Charged: How to Vet Your Incident Response Firm
A Canadian ransomware negotiation executive was charged in the US on October 8, 2026. Nothing is proven, but it is a good reason to check how you woul...
Read more
Canadian Small Business Cyber Risk Report 2026: Six Findings by Business Size
Our Canadian Small Business Cyber Risk Report 2026 breaks public data out by business size: 14.3% of firms with 10 to 49 employees were hit in 2023, a...
Read more
Website Security for Canadian Small Businesses: What the Baseline Controls Expect
The CCCS Baseline Controls include a specific control for secure websites. Here is the checklist every Canadian small business should follow to meet B...
Read more
Canadian Mennonite University Data Breach: Tax Data Retention Lessons
A cyberattack at Canadian Mennonite University exposed T4s, T2202s, and SINs going back to 2015. The incident highlights why Canadian organizations sh...
Read more
CIRA 2026 Survey: Canadian Cybersecurity Budgets Up, Confidence Down
76% of Canadian organizations increased cybersecurity budgets in 2026, yet only 67% believe their spending is enough. The CIRA survey of more than 500...
Read more
Bill C-8 Is Law: Who Canada's New Cyber Security Act Covers and When It Applies
Bill C-8 received Royal Assent on June 15, 2026, enacting the Critical Cyber Systems Protection Act. Here is who it covers, what designated operators...
Read more
Cyber Security Awareness Month Canada 2026: A Practical Checklist for Small Businesses
October is Cyber Security Awareness Month in Canada. The 2026 theme from Get Cyber Safe is 'Your best defence is you.' Here is a week by week checklis...
Read more
How to Report a Cyber Attack in Canada: Where Your Business Should Go First
To report a cyber attack in Canada, businesses use the RCMP's National Cybercrime and Fraud Reporting System, the Cyber Centre, local police and, for...
Read more
Cybersecurity Canada: The Readiness Gap and How to Close It
73% of Canadian SMBs have experienced a cybersecurity incident, yet only 48% believe they are vulnerable. Here is how to close the gap.
Read more
Canadian Cybersecurity Assessment: What It Is and How to Start
A Canadian cybersecurity assessment benchmarks your organization against the Government of Canada's 13 Baseline Controls. Here is what the process inv...
Read more
Quebec Law 25 Compliance for Canadian Businesses Outside the Province
Quebec's Law 25 privacy rules apply to any Canadian business with Quebec customers, regardless of where the business is located. Here's what out-of-pr...
Read more
Interac e-Transfer Fraud: How Canadian Businesses Lose Money to Payment Redirection
Spear phishing cost Canadians $57.7 million in reported losses in the first six months of 2026. Payment redirection and Interac e-Transfer interceptio...
Read more
Ransomware Claims Hit Canadian Peers: What Your Small Business Should Do Now
Multiple ransomware groups claimed Canadian victims in early October 2026, from electrical distributors to healthcare facilities. Here is what Canadia...
Read more
Network Security Services for Canadian Small Businesses: What They Should Cover
Network security services protect your firewall, Wi-Fi, remote access and internet traffic. Here is what the Canadian Centre for Cyber Security's base...
Read more
Stolen ID Scans Canada: OPC Opens PIPEDA Investigation into IDScan.net Breach
The Privacy Commissioner of Canada has opened a PIPEDA investigation into a data breach at IDScan.net involving stolen driver's licences and governmen...
Read more
Biggest Cyber Attacks in Canada: 5 Lessons for Small Businesses
Some of the biggest cyber attacks in Canada since 2023 hit Indigo, the Toronto Public Library, Hamilton, London Drugs and Nova Scotia Power. Here is w...
Read more
Managed Detection and Response in Canada: A Small Business Guide
Managed detection and response (MDR) gives a Canadian small business a team that watches its devices around the clock and acts on threats. Here is wha...
Read more
Cybersecurity Services in Canada: What a Small Business Needs First
Cybersecurity services range from paid ISP add-ons to 24/7 managed detection. The Canadian Centre for Cyber Security says five controls can be done wi...
Read more
Secure Configuration and Hardening Checklist for Small Business IT
Most business hardware and software still ships with default settings built for convenience, not security. This guide walks Canadian SMBs through secu...
Read more
Token Theft and AiTM Phishing: Why First-Generation MFA Is Failing Canadian Businesses
Attackers no longer break multi-factor authentication. They wait for you to complete it and steal the session token instead. In April 2026 Microsoft d...
Read more
Antivirus and Anti-Malware: What Canadian Small Businesses Actually Need
Email attachments and links remain the single biggest way malware reaches a business, delivering roughly 41% of infections. Here's what anti-malware p...
Read more
Mobile Security for Canadian Small Businesses: Company Phones or BYOD?
Mobile security starts with one decision: who owns the phone. The Canadian Centre for Cyber Security compares company-owned and bring-your-own-device...
Read more
Patch Management Best Practices for Canadian Small Businesses
Vulnerability exploitation overtook stolen credentials as the top breach cause in 2026, and the median business now takes 43 days to patch. Here's a p...
Read more
Physical Threats to Digital Devices: How Canadian Businesses Protect Laptops and Phones
Physical threats to digital devices include theft, loss, tampering, shoulder surfing and careless disposal. The Canadian Centre for Cyber Security war...
Read more
Frontier AI and Cyber Security: What Canada's Cyber Centre Wants Businesses to Do Now
On June 24, 2026, the Canadian Centre for Cyber Security warned that frontier AI is shrinking the time defenders have to respond, from days or weeks t...
Read more
Amazon Prime Day Scams 2026: Spot Fake Amazon Sites
Check Point found 87% of new Amazon-themed domains were malicious ahead of Prime Day 2025. Here's how Canadian shoppers can spot fake sites, phishing,...
Read more
Who Is Responsible for Cybersecurity in a Canadian Small Business?
Who is responsible for cybersecurity in a small business? The business is, even when IT is outsourced. Here is what the Canadian Centre for Cyber Secu...
Read more
Anthropic's Call for a Global AI Pause: What It Means for Canadian Businesses
On June 4, 2026, Anthropic (valued near $1 trillion) urged a coordinated global pause on frontier AI development, warning models may soon improve them...
Read more
The Cybersecurity Canada Report 2026: Seven Findings Canadian SMBs Should Know
Canadians lost a record CA$704M to fraud in 2025. Microsoft documented a threat actor specifically targeting Canadians. Mandiant says attackers now ha...
Read more
Claude Mythos and Glasswing: What Canadian SMBs Should Do
Claude Mythos found 10,000+ high and critical zero-days under Project Glasswing. Why the patch backlog is the real risk for Canadian SMBs, and what to...
Read more
Canada Post Phishing Emails, Fake CRA Texts, and Interac Scams
Canadians lost $638 million to fraud in 2024. Most attacks start with a fake CRA text, Canada Post phishing email, or Interac e-Transfer scam. Learn t...
Read more
Canvas Data Breach 2026: Canadian Guide
UBC, U of T, SFU, and other Canadian universities were hit by the Canvas breach. Names, emails, and student IDs exposed. Here is what to do now.
Read more
Agentic AI Security for Canadian Businesses: What the New Cyber Centre Guidance Means
Canada's Cyber Centre and four allied agencies published Careful Adoption of Agentic AI Services on May 1, 2026. Here's what the new agentic AI securi...
Read more
Canada Life Data Breach: What to Do Now
The Canada Life breach exposed 70,000 records via a compromised employee account. Learn what data was taken and how to protect yourself now.
Read more
Cybersecurity Laws in Canada: Which Apply to Your Business?
PIPEDA, CASL, Quebec Law 25, provincial privacy acts and critical infrastructure rules: a plain-language guide to the laws Canadian businesses must fo...
Read more
Cybersecurity Certifications in Canada: CyberSecure Canada and the Professional Credentials That Matter
An overview of the cybersecurity certifications that matter in Canada in 2026, including the CyberSecure Canada program for organizations and the prof...
Read more
A Brief History of Cybersecurity in Canada: From Cold War Signals Intelligence to the Canadian Centre for Cyber Security
Canada's cybersecurity institutions have a long, specific history: from the Second World War signals intelligence agency that became CSE, through PIPE...
Read more
Understanding CVSS Scores: What the Numbers Behind Software Vulnerabilities Actually Mean
When a vulnerability is rated 8.8 or 10.0, what does that actually mean for your business? Here's a plain-language guide to CVSS scores and why they m...
Read more
How to Choose a Cybersecurity Provider for Your Canadian Small Business
Managed service providers, MSSPs, consultants, and vCISOs: the options for outsourced cybersecurity are growing. Here's how Canadian small businesses...
Read more
Why Our Free Cybersecurity Assessment Doesn't Collect Your Data
Most online assessment tools require your email before showing results. Ours doesn't collect anything: not your name, not your email, not your answers...
Read more
What Canadian Businesses Need to Know About Bill C-26
Bill C-26's cybersecurity provisions (now reintroduced as Bill C-8) would impose mandatory obligations on critical infrastructure operators in Canada....
Read more
New PIPEDA Enforcement Actions: What Changed and What Canadian SMBs Must Do Now
The Office of the Privacy Commissioner of Canada is enforcing PIPEDA more aggressively than ever. Here's what recent enforcement actions mean for smal...
Read more
AI-Powered Phishing: What's Changed for Canadian Businesses in 2026
AI tools have made phishing emails faster to create, harder to detect, and more convincing than ever. Here's what Canadian small businesses need to kn...
Read more
Building an Incident Response Plan for Your Canadian Business
The Canadian Centre for Cyber Security designates incident response planning as the first of its 13 Baseline Controls. Here is what the guidance says,...
Read more
What to Do in the First 24 Hours After a Cyber Attack
When a cyber attack hits, the decisions you make in the first hours determine how much damage your business sustains. This step-by-step guide walks Ca...
Read more
Cyber Insurance: What Canadian SMBs Need to Understand
Cyber insurance adoption among Canadian businesses remains low, and denied claims are making headlines. Here is what the market looks like, what insur...
Read more
Ransomware: What Canadian Businesses Need to Know Before, During, and After an Attack
Ransomware remains the top cybercrime threat facing Canadian organizations. Here is what Canadian SMBs should do before an attack happens, what to do...
Read more
USB Drives and Portable Media: The Security Risk Sitting in Your Desk Drawer
USB drives remain one of the easiest ways for data to leave your business and one of the quietest ways for threats to get in. Here's what Canadian SMB...
Read more
Vendor and Third-Party Risk: How Your Suppliers Can Become Your Weakest Link
Your cybersecurity is only as strong as the least secure vendor with access to your systems or data. Here's how Canadian small businesses can assess a...
Read more
Windows Notepad Vulnerability: What Canadian Businesses Should Know
A critical flaw in Windows Notepad could let attackers take control of your PC through a simple file. Here's what Canadian business owners need to kno...
Read more
Notepad++ Supply Chain Attack: What Canadian Businesses Should Know
A Chinese state-sponsored group hijacked Notepad++ updates for months, delivering targeted malware through a trusted update channel. Here's what happe...
Read more
The Hidden Cost of Assuming Your Business Is Too Small to Attack
The belief that your business is too small to be targeted isn't just wrong. It's the most expensive cybersecurity assumption a Canadian SMB can make....
Read more
How to Use Your Cybersecurity Assessment Results
Completed the assessment? Here's how to interpret your score, prioritize improvements, and build a practical security roadmap for your organization.
Read more
Why Canadian SMBs Can No Longer Ignore Cybersecurity
Canadian small businesses face growing cyber threats. Learn why cybersecurity has become a business necessity, not just an IT concern.
Read more
When Cyber Attacks Become Physical Threats
Cyber attacks don't always stay digital. Criminals are using email compromises, system hacks, and signal jamming as stepping stones to physical crimes...
Read more
Backup and Recovery: 5 Assumptions That Fail When It Matters
Most businesses think their backups are fine, until they try to restore from them. Here are five common backup assumptions that fail during a real inc...
Read more
Why Your Canadian Business Needs an AI Usage Policy
Your employees are already using AI tools, with or without your knowledge. Here's why a clear AI usage policy protects your business and what it shoul...
Read more
Understanding Canada's Baseline Cyber Security Controls for SMBs
The Canadian Centre for Cyber Security has published baseline controls specifically designed for small and medium organizations. Here's what you need...
Read more
The Real Cost of Cyber Downtime for Canadian SMBs
When systems go offline due to a cyber incident, the costs go far beyond the ransom demand. Here's what Canadian small businesses actually face.
Read more
Business Email Compromise (BEC): Canada's Most Costly Cyber Threat
Business email compromise doesn't use malware or exploit software vulnerabilities. It exploits trust, and it's responsible for more financial losses t...
Read more
Remote Work Security for Canadian Businesses
Remote and hybrid work is here to stay. Here's how Canadian SMBs can keep their data secure when employees work outside the office.
Read more
Cloud Security Basics for Canadian Small Businesses
Moving to the cloud doesn't mean your data is automatically secure. Microsoft 365, Google Workspace, and other cloud platforms require configuration,...
Read more
How to Recognize Phishing Emails: A Guide for Canadian Businesses
Phishing is the number one cyber threat to Canadian businesses. Learn the warning signs and how to protect your organization.
Read more
Employee Security Awareness Training: What Actually Works
Annual compliance videos don't change behaviour. Here's what the research says about effective security awareness training for Canadian small business...
Read more
Password Security: What Canadian Businesses Get Wrong
Forced password rotation, short minimums, and no password manager: here are the most common password mistakes Canadian SMBs make and how to fix them.
Read more
Multi-Factor Authentication: The Single Biggest Security Upgrade for Canadian SMBs
MFA blocks over 99% of automated account attacks. It's free to enable on most business platforms, takes minutes to set up, and is increasingly require...
Read more
Why Cybercriminals Target Small Businesses
Small businesses are not too small to be targeted. Here's why cybercriminals see Canadian SMBs as attractive targets and what you can do about it.
Read more
5 Easy Cybersecurity Wins for Canadian Small Businesses
You don't need a massive budget or a dedicated IT team to meaningfully improve your cybersecurity. These five actions can be implemented quickly and a...
Read more
Canada's Privacy Landscape: What Small Businesses Need to Know
PIPEDA, provincial laws, and breach reporting: a plain-language overview of the privacy obligations that apply to Canadian small businesses.
Read more