The cost of data breaches to Canadian businesses has reached a record high of more than $7 million on average, according to a new report from IBM, with critical infrastructure being some of the most costly targets for these attacks.
Targeting vital sectors can have consequences beyond the financial hit, including compromising supply chains, the report said.
“The shift we’re seeing is significant. Attackers are increasingly targeting sectors where disruption creates real operational and economic consequences, while also looking for the weakest link in the supply chain,” Chris Sicard, IBM Canada security leader, said in a separate release.
“When breaches affect energy, industrial and technology organizations, the impact can extend far beyond the organization itself. Every connected supplier, partner, and third-party platform expands the attack surface.”
The IBM Cost of Data Breach Report for 2026, released Wednesday, was conducted by Ponemon Institute and sponsored and analyzed by IBM. It was based on reported breaches of 602 global organizations between March 2025 and February 2026, with a followup study conducted in May 2026 asking about the awareness of newly developed advanced AI threats.
The report found that the global average cost for a data breach hit US$4.99 million (about C$7 million). That’s also 12 per cent higher than a year earlier.
Canadian organizations reported a record-high average cost of US$5.2 million (about C$7.3 million) for each data breach, and up from US$4.84 million (approximately C$6.8 million) a year earlier, according to the report.
Canada also ranked fourth worldwide for the average cost of a data breach, with the United States paying the most at US$11.5 million per incident. The Middle East region was second at $8 million on average per incident, and Benelux (a political-economic union of countries comprised of Belgium, the Netherlands and Luxembourg) was third, paying $7.37 million for each data breach.
The most costly impacts from data breaches that targeted Canada’s energy sector averaged C$9.21 million per incident, while technology organizations saw data breaches cost an average of $9.02 million each, and the industrial sector reported a cost per incident of $8.89 million on average, according to the release.
IBM also said in the release that supply chain compromises are the single most costly impact from these data breaches, averaging C$367,899 per incident.
Get daily National news
Get daily Canada news delivered to your inbox so you’ll never miss the day’s top stories.
“Supply chains are trusted ecosystems of suppliers and service providers that enable organizations to develop and deliver products and services,” the federal government’s Canadian Centre for Cyber Security says in its guidelines.
“Supply chains provide an extended attack surface against Canadian organizations and an alternative for cyber threat actors to direct action against an organization’s networks.”
IBM said that after supply-chain compromises, security skills shortages are the next most expensive factor for Canadian businesses, with an average cost of C$314,500 per data breach, and the challenges to prioritize threats as they are detected cost an average $311,300 for each incident.
These data breaches are also reportedly growing in scale and lasting longer.
IBM also said the average number of compromised records exposed to these attacks hit 28,500, which was an eight per cent increase over the previous year’s report, and each data breach lasted an average of 205 days, up six per cent year over year.
The IBM report says security for these organizations can be compromised even if businesses have a robust cybersecurity system. That’s because many of these breaches don’t always happen directly, and attackers may be using back-door tactics like trusted third-party suppliers, contractors, software vendors or business partners.
The IBM report also says artificial intelligence is considered a serious attack threat, but some AI tools can also help protect against and reduce the financial and operational impacts of data breaches.
Twenty-eight per cent of Canadian organizations said they were hit by an AI-generated attack, according to the IBM release.
At the same time, companies that used AI in their cybersecurity operations reported less of a financial hit, with an average of $5.5 million in costs from each incident, while the average cost was $8.91 million for organizations with no AI tools deployed.
Firms that used AI tools also were able to identify and contain data breaches faster than those without the use of AI in their cybersecurity arsenal.
Those with AI tools detected incidents within 124 days and they were contained in 57, compared with companies that did not use AI tools taking 154 days to detect an incident and 71 days to contain it.
“The organizations gaining the biggest security advantage are the ones using AI and automation extensively across their operations,” Sicard said in the release.
“They’re finding threats sooner, responding faster and reducing the financial impact of breaches by millions of dollars.”
The IBM report comes about one month after cybersecurity agencies for Canada and its Five Eyes allies issued a whole-of-society “call to action” that warned that artificial intelligence is “rapidly transforming cyber risk,” allowing attackers to exploit vulnerabilities at ever-increasing speed.
At the same time, the joint advisory said AI offers “powerful tools” to strengthen cyber defences and urged organizations to integrate them into their core business strategies.
— with a file from Global’s Sean Boynton
© 2026 Global News, a division of Corus Entertainment Inc.