It happened to firms like yours.

Real incidents at Canadian firms and organisations — what failed, what it cost, and how long nobody noticed.

Every case is drawn from a primary document — a regulator's published decision or the organisation's own reports. We don't name the firms; the evidence behind every claim is linked inside each case.

City of Hamilton · Ontario · February 2024

Their insurer refused every ransomware claim — MFA was started, not finished.

$5M of claims refused by the insurer

Recovery cost $18.3M — and the policy said started doesn't count. The city disputes that MFA would have changed the outcome.

Missing control: Multi-factor authentication, started but not finished

Source: Report CM25008 (the denial) Read the case →

a health clinic · Ontario · October 2023

Ransomware at a shared IT provider put patient records on the dark web.

6 organisations reached through one shared IT provider

Five hospitals and one small clinic bought IT from the same provider. The regulator found the clinic's contract was missing security clauses the hospitals' agreement carried.

Missing control: Privileged account management on administrator accounts, including MFA

Source: IPC Case of Note, PHIPA Decision 284 Read the case →

an accounting practice · Alberta · April 2021

Phishing, then ransomware — and the clients’ names, birthdates and SINs were gone.

1,570 clients whose names, dates of birth and SINs were taken

One April morning the servers wouldn't log in. The attackers claimed they destroyed the data afterwards; the Commissioner said other copies can't be ruled out.

Missing control: Two-step authentication on servers — bought immediately afterwards

Source: Decision P2021-ND-342 Read the case →

a registered psychologist’s practice · Alberta · March 2021

One phishing email took over the mailbox. The patients had to be told.

207 patients the practice was ordered to notify

Someone at a one-practitioner psychology practice answered an email that looked like it came from Microsoft. Days later the mailbox belonged to somebody else, and every contact in it received a request to buy gift cards.

Missing control: Two-factor authentication, added afterwards and only on “most” accounts

Source: Decision P2022-ND-015 Read the case →

a sole-practitioner law firm · Alberta · December 2019

The firm’s hard drive was stolen from its IT provider’s vehicle.

150 people whose files left in a third party’s vehicle

A desktop failed. The firm's IT provider took the hard drive away to see what could be recovered — and it was stolen out of the provider's vehicle before anyone had thought about what was on it.

Missing control: Nothing recorded — including whether the drive was encrypted

Source: Decision P2020-ND-137 Read the case →

a law firm · Alberta · November 2019

Fraud went out from the firm’s own email while the employee was on vacation.

≈400 people the firm was ordered to notify, after mail went out in its name

Mail went out from a law firm's own address while the employee who owned it was away. They found out when another law firm contacted them about a suspicious message.

Missing control: Nothing stopping the firm’s own address being used, and no way to notice it

Source: Decision P2020-ND-033 Read the case →

a national health-profession association · Canada · October 2019

They paid the invoice — to a criminal impersonating their supplier.

Gone paid to a criminal who had spent weeks inside their mailboxes

Somebody was reading two staff mailboxes for weeks. When the real supplier asked where its payment was, the organisation found out it had already wired the money to the person impersonating them.

Missing control: Multi-factor authentication and staff training — both bought afterwards

Source: Decision P2020-ND-048 Read the case →

a real-estate law practice · Alberta · September 2019

A staff mailbox was silently forwarding the firm’s mail to criminals.

6 weeks of incoming mail copied out of the firm before anyone noticed

Every message into a staff mailbox was silently copied out — until a scam email arrived, asking the firm to deposit funds.

Missing control: Nothing watching for a mail-forwarding rule on a staff account

Source: Decision P2021-ND-027 Read the case →

a wealth management firm · Alberta · January 2019

One phishing click. The client file has not been recovered.

767 clients exposed — with their account numbers and assets under management

A phishing email went to the whole firm. One person opened it, and the attacker took the client contact file — names, social insurance numbers, account numbers, and how much each client had invested.

Missing control: Multi-factor authentication on staff mailboxes

Source: Decision P2019-ND-074 Read the case →

a wealth management firm · Alberta · December 2018

The advisor’s own mailbox started sending phishing. A recipient noticed first.

2 months between the click and anybody noticing

An advisor clicked a link in December. Nothing happened. In February the mailbox started sending phishing emails — and the firm found out because one of the recipients told them.

Missing control: Multi-factor authentication on the mailbox, and anything watching it

Source: Decision P2019-ND-099 Read the case →

a firm holding its clients’ banking details · Alberta · November 2015

The attacker hid every incoming message in Deleted Items. Nobody noticed.

7 months between the click and the phone call that revealed it

It went on for seven months. A phone call from one of the recipients ended it — nothing the firm ran ever did.

Missing control: Anything watching the mailbox, including the rule the attacker left behind

Source: Decision P2019-ND-063 Read the case →

Which of these could happen to you this month?

No cost, no obligation — you keep the findings either way.

Get your free Security Snapshot

Claim	Figure	Basis
Most small firms have no security budget at all	84.5%	of Canadian businesses with 5–19 employees had no dedicated cybersecurity budget (92.0% at 1–4 employees; 69.8% at 20–99). Separately, most businesses (54.4%) had no plans to take any new or additional cybersecurity action in the following 12 months, and the most common reason given was not needing cybersecurity measures (57.1%).
Most small Canadian professional firms can be impersonated by email	77%	of small Canadian professional firms with a website have no enforced DMARC — meaning anyone can send email that appears to come from them, and the receiving server has not been told to reject it. We measured this ourselves across 3,821 firm domains, because no independent source publishes it.
Recovery spending doubled in two years	$1.2 billion	is what Canadian businesses spent recovering from cyber security incidents in 2023, double the roughly $600 million spent in 2021 — while total spending on prevention and detection rose only from $9.7 billion to $11.0 billion. Small businesses accounted for about $300 million of the recovery bill.
For most small firms, the IT provider IS the security plan	50%	of Canadian businesses had any employees responsible for cyber security in 2023 — down from 61% in 2021. Among those without, the most common reason given was that they use consultants or contractors instead (47%).
Your CCO personally certified your cybersecurity answers to the OSC	G10	Every OSC-registered firm answers the Risk Assessment Questionnaire, and from 2026 the Chief Compliance Officer must personally certify each section — including Question G10 on cybersecurity. CIRO Dealer Members additionally have three days from discovering an incident to report it. Neither the certification nor the deadline can be satisfied by a firm that would not notice an incident in the first place.
Clients and partners now require security measures in writing	44%	of Canadian businesses were required to implement cyber security measures by suppliers, customers, partners or regulators, or to meet the requirements of security standards or certification programs — up from 29% two years earlier. Statistics Canada, 2019 and 2017. Inside the legal profession the ABA measures the same pressure directly, and finds it concentrated in larger firms: 15% at 2–9 lawyers against 59% at 50–99.
Your insurer asks whether you enforce MFA before it will quote you	MFA	is the control insurers ask about first, in writing, on their own application forms — Coalition's Canadian questionnaire and Beazley's US one both ask whether it is enforced on email and remote access, alongside tested backups and patching. Aon's 2025 report still calls it "an underwriting requirement" in a buyer-friendly market. Travelers rescinded a policy after a ransomware claim where the MFA represented on the application did not exist.
Corporate clients hand law firms a security schedule — their own association wrote one	24 hours	is the breach-notification window in the Association of Corporate Counsel's model security schedule — a ready-made set of controls written for in-house counsel to impose on the outside firms they retain. 27% of US law firms have been asked for their security requirements document; at 2–9 lawyers it is 15%.

Figure	What it measures
84.5%	of Canadian businesses with 5–19 employees had NO dedicated cybersecurity budget, Q3 2024. By size: 92.0% at 1–4 employees, 84.5% at 5–19, 69.8% at 20–99, 43.2% at 100+. Statistics Canada table 33-10-0875-01, vector v1594328208; StatCan rates this estimate's quality "excellent".
54.4%	of businesses had no plans to take new or additional cybersecurity actions over the next 12 months — and among the reasons given, the most common was not needing cybersecurity measures (57.1%). That is the "hope" in the sentence above. Canadian Survey on Business Conditions, Q3 2024.
37.0%	of Canadian legal-services businesses had no employee whose regular responsibilities include cyber security in 2023 — 38.6% of accounting, tax and bookkeeping practices, and 37.6% of ambulatory health care. Statistics Canada table 22-10-0129-01, vectors v1212389881 / v1212389887 / v1212390001.

Figure	What it measures
77%	of small Canadian professional firms WITH A WEBSITE have no enforced DMARC — anyone can send email that appears to come from them. The frame is firms we could find a domain for, so the figure describes firms with a web presence.
81.7%	clinics and health practices
73.1%	law firms
72.4%	accounting practices

Figure	What it measures
$1.2 billion	"Total spending on recovery from cyber security incidents also increased in 2023, doubling from approximately $600 million in 2021 to $1.2 billion in 2023." Prevention and detection spending over the same period went from $9.7 billion to $11.0 billion — recovery is the line that doubled.
$300 million	"Large businesses accounted for almost half of total spending on recovery from cyber security incidents in 2023 (about $500 million), while medium-sized and small businesses each spent approximately $300 million." Small businesses carry a quarter of the national recovery bill.
≈ $12,600	OUR ARITHMETIC, shown so you can check it: $300 million ÷ ≈23,800 small businesses impacted in 2023 (170,000 × 14%, the same calculation as the "1 in 7" table on this page). It is an average, and a skewed one — among small businesses actually impacted in 2023, 35.5% described the incident's effect as minor (Statistics Canada table 22-10-0133-01), so most sit below this figure and a few sit far above it.
Not in this number	Lost clients, lost billable hours, the cost of notifying everyone whose data was in a mailbox, and reputational damage. StatCan measures money spent recovering, not total harm. For a professional firm the uncounted half is usually the larger one, and no Canadian source quantifies it at this size — which is why we do not put a figure on it here.