Toronto, Ontario -- Canada will see three times as many successful, disruptive and globally significant cyber attacks in 2025 as it did in 2023, according to QBE’s latest Control Risks Report.
The insurer expects 32 major cyber incidents to affect Canadian organizations by the end of this year — up from 18 in 2024 and just 10 in 2023. These attacks include ransomware, data breaches and other digital incidents with both national and international consequences.
The findings are based on cyber incident tracking by Control Risks and supported by new research commissioned by QBE among 400 medium-sized Canadian businesses. Four in five businesses — 80 percent — feel cyber threats have increased in Canada over the past year.
The research highlights that 53 percent of Canadian businesses have experienced a cyber event in the past 12 months. 18 percent of those incidents resulted in an interruption of one working day or more, while 35 percent caused a disruption lasting less than a day.
Half of cyber attacks — 51 percent — led to revenue loss. Among affected businesses, 58 percent said that some, most or all of the incidents were related to a supplier.
“Businesses are increasingly connected to one another," said Kyle Gray, technical underwriter team lead, cyber for QBE. "Strengthening their internal digital security is still very important. However, if they forget to look at their suppliers’ vulnerabilities, they will remain exposed. Risk management will need to look at their entire IT supply chain, with focus on their critical suppliers.”
In total, 78 percent of businesses said they are concerned about the cyber threats they may face in the coming year, with 53 percent somewhat concerned and 25 percent very concerned. Some 28 percent anticipate their cybersecurity budgets will increase beyond inflation over the next 12 months, while 41 percent said budgets will grow in line with inflation.
Despite that concern, 25 percent of those surveyed still do not have cyber insurance, and 15 percent have no incident response plan in place.
Almost all Canadian businesses — 94 percent — are either already using artificial intelligence (71 percent) or actively looking into it (23 percent). 87 percent believe AI will have a positive impact on Canada’s economy in the next two years, and 86 percent believe it will benefit their own operations over that same period.
Some businesses have already experienced the consequences of cyber attacks. In 2019, Craftsman Collision in North Vancouver was hit by ransomware that hijacked systems and sent phishing emails to customers. The company lost hundreds of thousands of dollars during its recovery. That same year, Gerber Collision’s parent company, the Boyd Group, also suffered a ransomware incident. While no customer or staff data was compromised, parts of the network were disrupted.
In June 2024, a ransomware attack on CDK Global—a software provider used by more than 15,000 North American dealerships—forced many collision centres to revert to manual parts ordering and paperwork. Shops across the continent reported lost revenue, delays and mounting vehicle backlogs. Some businesses filed lawsuits, claiming tens of thousands in losses directly tied to the disruption.
While awareness and investment are rising, QBE’s findings suggest many Canadian businesses still aren’t ready. For those in the collision sector, the fallout is no longer theoretical.
