Canadian Data Breaches Hit Record Costs in 2026, IBM Report Finds A new report from IBM reveals that data breaches in Canada reached an average cost of $7.11 million per incident in 2026, up from $6.98 million in 2025. The breaches exposed an average of 28,500 records an 8% increase from the previous year and took 205 days to detect and contain, a 6% rise in response time. The rising costs stem from the complex aftermath of breaches, including business disruption, recovery efforts, legal obligations, and customer communications, according to Chris Sicard, IBM Canada’s security leader. Some companies even pass recovery expenses to clients, amplifying the financial strain. The report defines data breaches as incidents compromising personally identifiable, financial, medical, or proprietary information, with some attacks exposing up to 115,380 records. High-profile Canadian companies including Rogers, Fido, Telus Digital, Loblaw, Canada Computers, and Ardene have reported breaches in 2026. Energy companies faced the highest average breach costs at $9.21 million, followed by technology firms ($9.02 million) and industrial organizations ($8.89 million). Sicard attributed the higher costs to their larger networks, sensitive data, and low tolerance for downtime, making them prime targets for attackers. The report also highlighted the role of AI in cybersecurity, with organizations using AI extensively reporting lower breach costs ($5.5 million vs. $8.91 million) and faster response times 124 days to detect and 57 to contain, compared to 154 days and 71 days for non-AI adopters. AI is increasingly used for vulnerability patching, breach detection, and containment, improving efficiency in mitigating attacks.

Akira Ransomware Gang Claims Breach of Canadian Retailer Ardene The Akira ransomware group has listed Canadian fashion retailer Ardene on its data leak site, alleging the theft of 58 GB of sensitive data. The breach reportedly includes financial records (audits, payment details, and invoices), customer and employee information (passports, driver’s licenses, emails, and phone numbers), and confidential corporate data. Ardene acknowledged a "cyber incident" in January that disrupted internal systems, causing shipping delays and temporary issues with its rewards program and gift cards. In a customer notification, the company stated it was unaware of any customer data being compromised "at this time" but did not confirm Akira’s claims or whether a ransom was demanded or paid. Akira, a prolific ransomware strain first detected in March 2023, is believed to have ties to the defunct Conti group. In 2025 alone, Akira claimed 769 attacks, with 94 confirmed by affected organizations. So far in 2026, the group has listed 94 victims, including Ardene, as well as companies in France, Denmark, and the U.S. Canada has seen a rise in ransomware attacks, with two confirmed incidents in 2026 Ardene and Lakelands Public Health (targeted by the Lynx ransomware gang). Past high-profile attacks include London Drugs (2024) and Harry Rosen (2022), which exposed 160,000 individuals. Headquartered in Laval, Quebec, Ardene operates over 300 stores across Canada, the U.S., and internationally, specializing in apparel, footwear, and accessories. The investigation into the breach remains ongoing.

Canadian Data Breaches Hit Record Costs as AI Emerges as a Key Defense Canadian companies faced rising financial and operational fallout from data breaches in 2026, with average costs climbing to $7.11 million per incident up from $6.98 million in 2025 according to an IBM report released this week. The breaches exposed an average of 28,500 records, an 8% increase from the previous year, and took 205 days to detect and contain, a 6% rise in response time. The financial burden stems not just from the attacks themselves but from the cascading effects: business disruption, recovery efforts, legal obligations, and customer impact. Some companies even passed recovery costs to clients, while others, like Rogers, Fido, Telus Digital, Loblaw, Canada Computers, and Ardene, reported breaches in 2026. Energy companies bore the highest average costs at $9.21 million per breach, followed by technology firms ($9.02 million) and industrial organizations ($8.89 million). IBM attributed the disparity to their complex networks, sensitive data, and low tolerance for downtime, making them prime targets for attackers. The report highlighted AI as a critical tool in mitigating breaches. Organizations using AI extensively in security operations reported lower average costs ($5.5 million vs. $8.91 million) and faster response times 124 days to detect and 57 to contain breaches, compared to 154 and 71 days for non-AI adopters. However, 28% of attacks studied were believed to be AI-generated, underscoring the technology’s dual role in cybersecurity. The study, conducted by the Ponemon Institute, analyzed 602 global organizations between March 2025 and February 2026, with follow-up interviews in May 2026. While the findings provide a snapshot of evolving threats, the methodology based on online surveys lacks a traditional margin of error due to non-random sampling.