Newly released 2025 survey data show cyber incidents affected about one in six businesses and that prevention tools were common but not universal.
The core finding
Statistics Canada reported October 21 that 16% of Canadian businesses were affected by cybersecurity incidents during 2025. That was unchanged from the survey's 2023 reading and below 21% in 2019. Large businesses reported impacts more frequently than smaller firms: 25% of large enterprises, 21% of medium-sized and 15% of small businesses. These survey results cover a defined 2025 reference period; they cannot by themselves establish what happened to all Canadian businesses in October 2026.
Fraud is prominent among affected firms
Among businesses reporting a cybersecurity incident, 55% identified scams or fraud as a method of attack, compared with 50% in 2023. Identity theft was identified by 28% and exploitation of vulnerabilities in software, hardware or networks by 23%. Ransomware was involved for 8% of impacted businesses, down from 13% in 2023. Among ransomware-affected businesses the survey found that 84% reported not making a ransom payment. Each method percentage has its own denominator and businesses may have experienced more than one.
Security practices and AI tools
Statistics Canada found 86% of businesses used at least one preventive cybersecurity measure in 2025. Email security was reported by 73%, anti-malware software by 69%, and network security by 67%. Eleven percent reported using AI-based cybersecurity tools; among large businesses the share was 46%. The survey does not establish that installing AI software alone prevents an incident, nor does it measure every potential application of artificial intelligence.
Policy context and limits
Separately, Canada's Privacy Commissioner released an October 23 submission on transparency for AI-generated content, interactions, system details, incidents and agents. That submission is input to a government consultation, not a newly enacted rule for every firm. Together, the sources show why digital services need clear communication about risk and controls; the cybercrime survey measures observed incidents and the regulator's statement addresses disclosure policy. They should not be merged into a single causal claim.
Sources & transparency
Statistics Canada — Impact of cybercrime on Canadian businesses, 2025Office of the Privacy Commissioner — AI transparency comments, October 23Original CDN News coverage. Sources are linked for reference.
Request a correction