If you have seen the headline that a growing share of Canadian businesses are getting attacked, the official data tells a more useful — and more nuanced — story.
According to Statistics Canada's Canadian Survey of Cyber Security and Cybercrime, the most rigorous national dataset, about 16% of Canadian businesses were impacted by a cyber security incident in 2023. That is actually down from 18% in 2021 and 21% in 2019. So the risk is falling — right?
Not evenly.
#The average hides who is actually improving
The decline is concentrated among large organizations that have invested heavily in security. Broken out by size, about 30% of large businesses reported an incident in 2023 — nearly double the national average. Small businesses report lower headline rates, but that is partly because smaller incidents get resolved quietly and never counted, not because small businesses are safe.
The national number is falling because big companies got better at defending themselves — not because the threat eased for everyone else.What the size breakdown shows
#Where the money actually goes
The cost side is where the story gets concrete. Canadian businesses spent roughly $1.2 billion recovering from cyber security incidents in 2023 — double the $600 million spent in 2021. And the nature of the damage is shifting. Ransom payments are not the main event: 88% of ransomware victims refused to pay, and of those who did, most paid under $10,000.
#What actually hits small businesses
Most small-business incidents do not look like the movies. They start with the ordinary: a convincing phishing email, a password reused across accounts, an invoice-fraud message from a "supplier," or a compromised vendor with access to your systems. The 2023 data shows scams and fraud remained the most common method, and identity-theft-based incidents jumped 11 points from 2021.
The businesses that get hurt are not the ones with the most valuable data — they are the ones with the least prepared backups and the fewest eyes on their systems.
#What "prepared" looks like for a small business
You do not need an enterprise security team. A defensible baseline for a small Canadian business is: multi-factor authentication on everything that matters, tested backups you have actually restored from once, a plan for the phishing email that will eventually get clicked, and someone — internal or a partner — watching for the incident instead of discovering it three weeks later.
That last part is the gap for most small businesses, and it is what managed detection is for. Through Rogers Business security solutions, Telebridge helps Alberta and B.C. businesses put a realistic baseline in place and get monitoring on the systems that would actually hurt to lose — sized for a small business, not an enterprise.
