Third-party cyberattacks rising in Canada 

Canadian businesses’ exposure to third-party cyberattacks is growing, QBE Canada research shows. 

More than half of Canadian businesses (53%) have experienced a cyber event in the past 12 months. And 58% of those businesses said those events were supply chain or vendor-related cyberattacks, according to the commercial insurer’s survey of 400 Canadian businesses’ IT departments.  

“Businesses are increasingly connected to one another,” Kyle Gray, technical underwriting team lead of cyber at QBE, observes. “Strengthening their internal digital security is still very important. However, if they forget to look at their suppliers’ vulnerabilities, they will remain exposed.

“Risk management will need to look at their entire IT supply chain, with focus on their critical suppliers.” 

In fact, significant cyber incidents have tripled in two years in Canada — from 10 in 2023 to 18 in 2024 and a projected 32 in 2025, according to QBE’s analysis of recent cyberattack data. 

Businesses are generally aware of the growing threat of cyberattacks. Four out of five (80%) businesses in Canada have noticed cyberattacks increasing in recent years. 

Most businesses are concerned about the cyber threats they could face in the next year. However, 28% of businesses expect to increase their cybersecurity spending by more than the rate of inflation over the coming year. Another 41% say their budget will increase in line with inflation. 

Will that be enough? Half of cyberattacks (51%) in Canada resulted in a loss of revenue, QBE research shows. 

Despite some heightened concern or priority being placed on cybersecurity among over a quarter of businesses, another 25% of those surveyed do not have cyber insurance, and 15% do not have an incident response plan to address a cyber event.  

Brokers say this presents an opportunity to step in with guidance and cyber insurance solutions for their clients.