Canada

This page covers cyber threats to Canada. It brings together official Canadian texts (the Canadian Centre for Cyber Security, the Parliament of Canada, the Office of the Privacy Commissioner of Canada, Public Safety Canada and the Newfoundland and Labrador government and privacy commissioner), joint advisories from the US, the UK and Canada, and Brandefense research. Where an official source names Canada as a target, the page says who said it and when.

Threat groups that official sources link to Canada

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT29: the UK National Cyber Security Centre advisory of 16 July 2020 says APT29 targeted various organizations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom during 2020. The UK NCSC and Canada’s Communications Security Establishment assess that APT29 is a cyber espionage group, almost certainly part of the Russian intelligence services.

LockBit: the joint advisory AA23-165A of 14 June 2023, co-sealed by the Canadian Centre for Cyber Security, says LockBit caused 22 percent of attributed ransomware incidents in Canada in 2022. It says the first recorded LockBit activity in Canada was in March 2020.

Lazarus Group: the US advisory AA21-048A (17 February 2021, revised 15 April 2021) lists Canada among the countries where AppleJeus malware was used against organizations since January 2020. The agencies attribute the Lazarus Group to North Korean state-sponsored actors.

Salt Typhoon: the Cyber Centre bulletin of June 2025 says it is aware of malicious activity targeting Canadian telecommunications companies, by actors it says are almost certainly People’s Republic of China state-sponsored, specifically Salt Typhoon. It says three network devices of a Canadian telecommunications company were compromised in mid-February 2025, using CVE-2023-20198. See also the incident page on Salt Typhoon.

Incidents on record

The incidents listed below are the major ones that Canadian authorities or the organizations themselves reported, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

What the Cyber Centre reports

The National Cyber Threat Assessment 2025-2026 says the People’s Republic of China presents the most sophisticated and active state cyber threat to Canada. It says Canada is very likely a valuable espionage target for Russian state-sponsored actors, that Iran is increasingly willing to run disruptive attacks beyond the Middle East, and that Indian state-sponsored actors likely run espionage against Government of Canada networks. It calls ransomware the top cybercrime threat to Canada’s critical infrastructure and says Canadian ransomware incidents known to the Cyber Centre grew 26 percent a year on average since 2021. The assessment lists examples such as the June 2023 MOVEit breach that affected the Government of Nova Scotia, the October 2023 ransomware incident that hit the IT provider of five hospitals in Southern Ontario, and the March 2024 ransomware incident at the City of Hamilton.

How attackers target Canada: Brandefense research

Ransomware. Our Q2 2023, Q3 2023 and Q4 2023 ransomware trends reports each say the USA, the UK and Canada were the most targeted countries by ransomware in that quarter. The 2025 ransomware post says the U.S. (61.3 percent), Canada and the UK remained primary targets, with North America at 69 percent of global incidents. The Q2 2026 post on the top five ransomware groups lists Canada among the countries where the group Qilin concentrates its victims. Our Medusa analysis says Medusa buys initial access only in six countries, Canada among them, and the AvosLocker summary lists Canada among its targets. The Weekly Security News Archive for the first half of 2023 carries the headline that Yellow Pages Canada confirmed a cyber attack as Black Basta leaked data.

Banking and fraud. The Weekly Security News Archive for Q4 2022 says financial service providers in Canada are among the hardest hit by the Godfather banking trojan.

State-linked. Our post on the Cicada APT group says the Chinese-supported group ran espionage campaigns against government agencies and non-governmental organizations in many countries, including Canada. The Mythic Leopard post lists Canada among the countries whose critical systems the group targeted. The Geopolitical Countdown post says Canada assessed that the Russian military was behind the AcidRain wiper attack of February 2022.

Actors with a Canadian link. Our Scattered Spider post describes the collective as mainly English-speaking actors located in the U.S., the U.K., Canada and Europe. The GC01 (Golden Chickens) post says that operation is believed to be run by people residing in Montreal, Canada, and in Romania or Moldova.

How Brandefense helps

Canadian security teams face state espionage, ransomware and fraud at the same time. Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and stolen data are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

Bill C-8, titled An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, received royal assent on 15 June 2026, according to the Parliament of Canada. Federal privacy in the private sector is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), and the Privacy Commissioner publishes guidance on mandatory reporting of breaches. Quebec has its own private-sector privacy act, and the Privacy Commissioner’s findings on the Desjardins breach say that organization is subject to both. The National Cyber Security Strategy funded the new Canadian Centre for Cyber Security and created the National Cybercrime Coordination Unit.

How incident response is organized

The Cyber Centre is part of the Communications Security Establishment. It calls itself Canada’s technical authority on cyber security and the single unified source of expert advice for Canadians and Canadian organizations. The National Cybercrime Coordination Unit expands the RCMP’s capacity to investigate cybercrime. The joint LockBit advisory tells Canadian ransomware victims to consider reporting to law enforcement, such as local police or the Canadian Anti-Fraud Center, and to the Cyber Centre through its online portal. In the Newfoundland and Labrador health case of 2021 the health center notified the Cyber Centre, the Royal Newfoundland Constabulary and the RCMP on 31 October 2021.

Sectors and rating

The sector table on this page shows which sectors official Canadian sources name. The Privacy Commissioner of Newfoundland and Labrador called the 2021 health cyber attack one of the largest in Canadian history by the number of people whose information was stolen. The Cyber Centre’s own assessment names no attack counts by sector. The official Canadian sources opened give no attack counts beyond the Cyber Centre ransomware growth rate above. Figures for Canada will come from Brandefense Atlas.