Canadian data breach costs top $7 million per incident

A new report published on July 30, 2026 found that the average cost of a data breach for Canadian businesses exceeded $7 million, according to the data cited in the document. Sources behind the repoSources said the pattern of attacks is shifting toward critical infrastructure and high-value corporate targets, a trend that is drawing attention from boards and insurers.

The repoSources said the headline figure reflects a mix of direct and indirect expenses that accumulate from the first response through recovery. It described costs such as forensic investigation, notifying customers, legal fees, and business interruption as key drivers of the total burden for organizations dealing with an incident.

Costs rising as detection takes longer

Sources said ransom demands and recovery spending are taking up a growing portion of overall losses. The report also linked higher average costs to longer detection and containment timelines, saying that delays in identifying and stopping breaches contributed to bigger financial outcomes per incident.

In its sector breakdown, the repoSources said organizations in energy, transportation, and health services faced the largest per-incident bills. Sources attributed the higher costs in these areas to incidents that can disrupt operations in addition to exposing or stealing data.

Insurers and boards reassess exposure

The repoSources said insurers and corporate risk managers are likely to revisit cyber coverage terms and pricing as losses build. It framed the current environment as one in which the scale of incident-related payouts and business interruption risks could push renewed scrutiny of premiums and conditions.

For businesses, the report described a trade-off that risk leaders may be forced to navigate: absorbing higher cyber-insurance costs versus funding additional controls and preparedness. It pointed to areas such as detection capabilities, network segmentation, and incident-response readiness as potential investment priorities.

Regulators and industry groups reviewing findings

The report urged faster detection and stricter controls around critical systems. Officials said regulators and industry groups are examining the findings, but the report did not detail what specific measures may follow or which bodies could take action.

Sources said the findings are expected to influence boardroom planning and insurer pricing through Q3 2026. The report added that market and policy reactions should be clearer by October 1, 2026, indicating that the near-term response from insurers, companies, and stakeholders remains an open question.