Data breaches are becoming more costly for Canadian companies, a new report suggests. Canadian organizations paid an average of $7.11 million per data breach in 2026, up from $6.98 million in 2025, according to research tech giant IBM released Wednesday. The average breach exposed 28,500 records, up eight per cent from last year, and took 205 days to detect and contain, a six per cent increase from 2025. It’s getting more expensive to tackle the breaches because addressing them takes a multi-faceted approach, said Chris Sicard, security leader at IBM Canada. “What drives costs higher isn’t just the attack itself,” he said in an email. “It’s everything that follows: business interruption, recovery efforts, customer communications, legal and regulatory obligations, and the impact on day-to-day operations.” IBM classifies data breaches as events where personally identifiable, financial, medical, confidential or proprietary information is put at risk. Up to 115,380 records were compromised in some of the breaches it studied. Sicard pointed out it’s not just companies that pay the price when their systems and data are compromised. Because of the damage that can be inflicted with stolen information and the way services are often disrupted or downed during breaches, customers are inconvenienced as well. In some cases, companies even pass along recovery costs to clients. Canadian telecommunications company Rogers and its subsidiary Fido, as well as Telus Digital, Loblaw Cos. Ltd., Canada Computers and Ardene have all reported breaches this year. However, it was energy companies that IBM found to have the highest average breach costs in Canada at $9.21 million per incident, followed by technology firms at $9.02 million and industrial organizations at $8.89 million. Sicard suspects their costs were larger because they tend to have bigger networks of customers, suppliers and business partners — making them a more lucrative target for attackers. “These organizations also tend to have complex environments, large amounts of sensitive data and very little tolerance for downtime,” he explained. Organizations using artificial intelligence extensively in their security operations reported average breach costs of $5.5 million, compared with $8.91 million among companies not using AI. Companies often use AI to find and patch vulnerabilities in their system. Some even rely on the technology for breach detection and containment. The report suggested adopters of the tech were also faster at addressing attacks. They took 124 days to detect attacks and 57 to contain them. Those without extensive AI needed an average 154 days for detection and 71 for containment. Of the attacks covered by the report, 28 per cent were believed to be AI-generated. IBM’s study was conducted by the Ponemon Institute, a Michigan-based independent research group that advocates for the responsible use of information and privacy management practices. The study used an online questionnaire to gather information on breaches experienced by 602 organizations globally between March 2025 and February 2026. A portion of the data came from telephone follow-ups in May 2026 that 456 of the 602 breached companies participated in. The Canadian Research Insights Council, an industry organization that promotes polling standards, says online surveys cannot be assigned a margin of error because they do not randomly sample the population. Tara Deschamps, The Canadian Press
