Canada Cyber Threat Profile

This page covers cyber threats to Canada. It brings together official Canadian texts. It also uses joint advisories from the US, the UK and Canada. The third source is Brandefense research. The Canadian texts come from these bodies:

• The Canadian Centre for Cyber Security.
• The Parliament of Canada.
• The Office of the Privacy Commissioner of Canada.
• Public Safety Canada.
• The Newfoundland and Labrador government and privacy commissioner.

Where an official source names Canada as a target, the page says who said it. It also says when.

Threat groups and ransomware that official sources link to Canada

Each group below has a profile in our threat group or ransomware library. Attribution is stated as given by the named body.

APT29: the UK National Cyber Security Centre advisory of 16 July 2020 says APT29 targeted various organizations involved in COVID-19 vaccine development. It names Canada, the United States and the United Kingdom as targets in 2020. The UK NCSC and Canada’s Communications Security Establishment assess that APT29 is a cyber espionage group. They say it is almost certainly part of the Russian intelligence services.

LockBit: the joint advisory AA23-165A of 14 June 2023 says LockBit caused 22 percent of attributed ransomware incidents in Canada in 2022. The Canadian Centre for Cyber Security co-sealed the advisory. It says the first recorded LockBit activity in Canada was in March 2020.

Lazarus Group: the US advisory AA21-048A (17 February 2021, revised 15 April 2021) lists Canada among the countries where AppleJeus malware was used. It was used against organizations since January 2020. The agencies attribute the Lazarus Group to North Korean state-sponsored actors.

Salt Typhoon: the Cyber Centre bulletin of June 2025 says it is aware of malicious activity against Canadian telecommunications companies. It says the actors are almost certainly People’s Republic of China state-sponsored, specifically Salt Typhoon. It says three network devices of a Canadian telecommunications company were compromised in mid-February 2025, using CVE-2023-20198. See also the incident page on Salt Typhoon.

Incidents on record

The incidents listed below are the major ones with national impact. Canadian authorities or the organizations themselves reported them. Where sources differ, the incident page says so. Small incidents are not listed.

What the Cyber Centre reports

The National Cyber Threat Assessment 2025-2026 says the People’s Republic of China presents the most sophisticated and active state cyber threat to Canada. It says Canada is very likely a valuable espionage target for Russian state-sponsored actors. It says Iran is increasingly willing to run disruptive attacks beyond the Middle East. It says Indian state-sponsored actors likely run espionage against Government of Canada networks.

The assessment calls ransomware the top cybercrime threat to Canada’s critical infrastructure. It says Canadian ransomware incidents known to the Cyber Centre grew 26 percent a year on average since 2021. It lists these examples:

• The June 2023 MOVEit breach that affected the Government of Nova Scotia.
• The October 2023 ransomware incident that hit the IT provider of five hospitals in Southern Ontario.
• The March 2024 ransomware incident at the City of Hamilton.

How attackers target Canada: Brandefense research

Ransomware. Our Q2 2023, Q3 2023 and Q4 2023 ransomware trends reports make the same finding. Each says the USA, the UK and Canada were the most targeted countries by ransomware in that quarter.

The 2025 ransomware post says the U.S. (61.3 percent), Canada and the UK remained primary targets. It adds that North America had 69 percent of global incidents.

The Q2 2026 post on the top five ransomware groups names the group Qilin. It lists Canada among the countries where Qilin concentrates its victims.

Our Medusa analysis says Medusa buys initial access only in six countries. Canada is among them. The AvosLocker summary lists Canada among its targets.

Banking and fraud. The Weekly Security News Archive for Q4 2022 says financial service providers in Canada are among the hardest hit by the Godfather banking trojan.

State-linked. Our post on the Cicada APT group says the Chinese-supported group ran espionage campaigns. The targets were government agencies and non-governmental organizations in many countries, including Canada. The Mythic Leopard post lists Canada among the countries whose critical systems the group targeted.

The Geopolitical Countdown post says Canada assessed that the Russian military was behind the AcidRain wiper attack of February 2022.

Actors with a Canadian link. Our Scattered Spider post describes the collective as mainly English-speaking actors. They are located in the U.S., the U.K., Canada and Europe. The GC01 (Golden Chickens) post says that operation is believed to be run by people residing in Montreal, Canada, and in Romania or Moldova.

How Brandefense helps

Canadian security teams face state espionage, ransomware and fraud. They face all three at the same time.

Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and stolen data are for sale. Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Parliament of Canada says Bill C-8 received royal assent on 15 June 2026. Its title is An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts.

Federal privacy in the private sector is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). The Privacy Commissioner publishes guidance on mandatory reporting of breaches. Quebec has its own private-sector privacy act. The Privacy Commissioner’s findings on the Desjardins breach say that organization is subject to both acts.

The National Cyber Security Strategy funded the new Canadian Centre for Cyber Security. It also created the National Cybercrime Coordination Unit.

How incident response is organized

The Cyber Centre is part of the Communications Security Establishment. It calls itself Canada’s technical authority on cyber security. It also calls itself the single unified source of expert advice for Canadians and Canadian organizations.

The National Cybercrime Coordination Unit expands the RCMP’s capacity to investigate cybercrime. The joint LockBit advisory tells Canadian ransomware victims to consider reporting to law enforcement. Examples are local police or the Canadian Anti-Fraud Center. It also tells them to consider reporting to the Cyber Centre through its online portal.

In the Newfoundland and Labrador health case of 2021, the health center notified three bodies on 31 October 2021. They were the Cyber Centre, the Royal Newfoundland Constabulary and the RCMP.

Sectors and rating

The sector table on this page shows the sectors that official Canadian sources name. The Privacy Commissioner of Newfoundland and Labrador called the 2021 health cyber attack one of the largest in Canadian history. It measured this by the number of people whose information was stolen.

The Cyber Centre’s own assessment names no attack counts by sector. The official Canadian sources opened give no attack counts beyond the Cyber Centre ransomware growth rate above. Figures for Canada will come from Brandefense Atlas.