OTTAWA- Data breaches and cyberattacks are growing increasingly expensive for Canadian organizations, according to a new report from tech giant IBM. In 2026, Canadian firms paid an average of $7.11 million per data breach, up from $6.98 million in 2025.
The average incident compromised approximately 28,500 records—an 8% increase from last year—and took an average of 205 days to detect and contain. Chris Sicard, security leader at IBM Canada, explained that the rising costs stem not only from the attack itself, but also from business interruption, recovery efforts, legal and regulatory obligations, customer communications, and operational downtime. In some instances, companies even end up passing recovery expenses on to consumers.
Energy sector companies faced the highest financial impact in Canada, averaging $9.21 million per breach incident, followed by technology firms at $9.02 million and industrial organizations at $8.89 million. High-profile Canadian businesses including Rogers, Fido, Telus Digital, Loblaw, Canada Computers, and Ardene have all reported security incidents this year.
The study also highlighted the critical role of artificial intelligence in mitigating damage. Organizations that extensively deployed AI and automation in their security operations reported average breach costs of $5.5 million, compared to $8.91 million for those without AI integration. Furthermore, AI-equipped firms were able to identify and contain threats significantly faster.
