The advisor’s own mailbox started sending phishing. A recipient noticed first.

a wealth management firm · Alberta · December 2018. A financial advisor clicked a phishing link in December 2018. Nothing happened for two months. Then the mailbox began sending phishing in the advisor's name — and the firm learned of it only when a recipient spoke up.

What happened

Identified in the record as Alberta OIPC Decision P2019-ND-099.

2 months between the click and anybody noticing

Missing control

Multi-factor authentication on the mailbox, and anything watching it

Alberta OIPC decision Read the original →

A third-party forensic audit later traced the start to December 2018, when the advisor received a phishing email containing a malicious link, and accessed it.

“No further activity was identified on the account until early February 2019, when the phishing emails were sent.”
Decision P2019-ND-099

When the account came back to life in early February 2019, it sent phishing emails that appeared to come from the advisor to eight Alberta residents. In between, whoever held the credentials had the mailbox itself — content typical of email exchanges between a financial advisor and their client.

“The incident was discovered when an individual who had received the phishing email informed the Organization.”
Decision P2019-ND-099

Nothing the firm ran detected it — not on the day of the click, and not in the two months after. The Commissioner found a real risk of significant harm and required the firm to notify the Alberta residents affected. Thirteen people were affected in all: a small incident by count, on the record here for its timeline.

The rule that applied — in Alberta

Alberta PIPA s.34.1 and s.37.1 — report the breach, then notify everyone affected

“There is a real risk of significant harm to the individuals affected by this incident. Pursuant to section 37.1 of the Personal Information Protection Act (PIPA), the Organization is required to notify those individuals whose personal information was collected in Alberta.”

The document

The part that matters

Two months passed between the advisor clicking the link and anyone realising. Nothing detected it — not the firm, not the software. One of the recipients of the phishing did. That gap is not unusual and it is not free: it is how long somebody else had the correspondence.

An advisor's mailbox holds the client's account numbers, tax information and the whole relationship in writing — the decision says so. That is true in every province. What travels best here is the timeline: the damage was not done on the day of the click.

What your own regulator and insurer require →

The documents

We hold dated copies — ask and we will send you what we read.

Document	Our copy
Decision P2019-ND-099	Copy held 2026-08-20

Thirteen people were affected, eight of them in Alberta. This is a small incident by count, and it is on this page for the timeline rather than the scale.

Who would notice, and how long would it take?

No cost, no obligation — you keep the findings either way.

Get your free Security Snapshot

Or see what we check for portfolio managers →

Claim	Figure	Basis
Most small firms have no security budget at all	84.5%	of Canadian businesses with 5–19 employees had no dedicated cybersecurity budget (92.0% at 1–4 employees; 69.8% at 20–99). Separately, most businesses (54.4%) had no plans to take any new or additional cybersecurity action in the following 12 months, and the most common reason given was not needing cybersecurity measures (57.1%).
Most small Canadian professional firms can be impersonated by email	77%	of small Canadian professional firms with a website have no enforced DMARC — meaning anyone can send email that appears to come from them, and the receiving server has not been told to reject it. We measured this ourselves across 3,821 firm domains, because no independent source publishes it.
Recovery spending doubled in two years	$1.2 billion	is what Canadian businesses spent recovering from cyber security incidents in 2023, double the roughly $600 million spent in 2021 — while total spending on prevention and detection rose only from $9.7 billion to $11.0 billion. Small businesses accounted for about $300 million of the recovery bill.
For most small firms, the IT provider IS the security plan	50%	of Canadian businesses had any employees responsible for cyber security in 2023 — down from 61% in 2021. Among those without, the most common reason given was that they use consultants or contractors instead (47%).
Your CCO personally certified your cybersecurity answers to the OSC	G10	Every OSC-registered firm answers the Risk Assessment Questionnaire, and from 2026 the Chief Compliance Officer must personally certify each section — including Question G10 on cybersecurity. CIRO Dealer Members additionally have three days from discovering an incident to report it. Neither the certification nor the deadline can be satisfied by a firm that would not notice an incident in the first place.
Clients and partners now require security measures in writing	44%	of Canadian businesses were required to implement cyber security measures by suppliers, customers, partners or regulators, or to meet the requirements of security standards or certification programs — up from 29% two years earlier. Statistics Canada, 2019 and 2017. Inside the legal profession the ABA measures the same pressure directly, and finds it concentrated in larger firms: 15% at 2–9 lawyers against 59% at 50–99.
Your insurer asks whether you enforce MFA before it will quote you	MFA	is the control insurers ask about first, in writing, on their own application forms — Coalition's Canadian questionnaire and Beazley's US one both ask whether it is enforced on email and remote access, alongside tested backups and patching. Aon's 2025 report still calls it "an underwriting requirement" in a buyer-friendly market. Travelers rescinded a policy after a ransomware claim where the MFA represented on the application did not exist.
Corporate clients hand law firms a security schedule — their own association wrote one	24 hours	is the breach-notification window in the Association of Corporate Counsel's model security schedule — a ready-made set of controls written for in-house counsel to impose on the outside firms they retain. 27% of US law firms have been asked for their security requirements document; at 2–9 lawyers it is 15%.

Figure	What it measures
84.5%	of Canadian businesses with 5–19 employees had NO dedicated cybersecurity budget, Q3 2024. By size: 92.0% at 1–4 employees, 84.5% at 5–19, 69.8% at 20–99, 43.2% at 100+. Statistics Canada table 33-10-0875-01, vector v1594328208; StatCan rates this estimate's quality "excellent".
54.4%	of businesses had no plans to take new or additional cybersecurity actions over the next 12 months — and among the reasons given, the most common was not needing cybersecurity measures (57.1%). That is the "hope" in the sentence above. Canadian Survey on Business Conditions, Q3 2024.
37.0%	of Canadian legal-services businesses had no employee whose regular responsibilities include cyber security in 2023 — 38.6% of accounting, tax and bookkeeping practices, and 37.6% of ambulatory health care. Statistics Canada table 22-10-0129-01, vectors v1212389881 / v1212389887 / v1212390001.

Figure	What it measures
77%	of small Canadian professional firms WITH A WEBSITE have no enforced DMARC — anyone can send email that appears to come from them. The frame is firms we could find a domain for, so the figure describes firms with a web presence.
81.7%	clinics and health practices
73.1%	law firms
72.4%	accounting practices

Figure	What it measures
$1.2 billion	"Total spending on recovery from cyber security incidents also increased in 2023, doubling from approximately $600 million in 2021 to $1.2 billion in 2023." Prevention and detection spending over the same period went from $9.7 billion to $11.0 billion — recovery is the line that doubled.
$300 million	"Large businesses accounted for almost half of total spending on recovery from cyber security incidents in 2023 (about $500 million), while medium-sized and small businesses each spent approximately $300 million." Small businesses carry a quarter of the national recovery bill.
≈ $12,600	OUR ARITHMETIC, shown so you can check it: $300 million ÷ ≈23,800 small businesses impacted in 2023 (170,000 × 14%, the same calculation as the "1 in 7" table on this page). It is an average, and a skewed one — among small businesses actually impacted in 2023, 35.5% described the incident's effect as minor (Statistics Canada table 22-10-0133-01), so most sit below this figure and a few sit far above it.
Not in this number	Lost clients, lost billable hours, the cost of notifying everyone whose data was in a mailbox, and reputational damage. StatCan measures money spent recovering, not total harm. For a professional firm the uncounted half is usually the larger one, and no Canadian source quantifies it at this size — which is why we do not put a figure on it here.