Identity Is the New Battleground: What Canada's 2026 Cybersecurity Report Reveals

The way criminals attack organisations is changing, and Canada offers a revealing snapshot of that shift. Rather than smashing through firewalls, today's most successful intruders are quietly walking through the front door using stolen credentials. A wave of new reporting for 2026 makes the trend impossible to ignore, and the headline finding is clear: the battle for security has moved decisively to the terrain of identity.

Identity attacks take the crown

According to the Cybersecurity Canada Report 2026, a striking 71 percent of organisations suffered an identity-related breach over the past year. Even more telling, 67 percent of all investigated incidents in 2025 stemmed from identity attacks, a bigger share than ransomware, software vulnerabilities or any other single category. Among ransomware victims specifically, the same 67 percent traced their ordeal back to a compromised identity.

Attacks now measured in seconds

Speed is the other dramatic change. The report found that the median time between an attacker gaining initial access and handing it off to a secondary group collapsed to just 22 seconds in 2025, down from more than eight hours only three years earlier. The average time for an intruder to move beyond their first foothold was 29 minutes, while the very fastest case was clocked at a mere 27 seconds.

For defenders, those numbers are sobering. When an intrusion can spread in less time than it takes to read a paragraph, the traditional model of spotting an alert and calmly investigating it no longer holds. Organisations are being forced to lean on automated defences and tighter identity controls simply to keep pace with the speed of modern attacks.

The rising cost of fraud

The financial toll is climbing in parallel. Reported fraud losses in Canada reached 704 million dollars during 2025, the highest figure on record, though the true national cost is estimated at somewhere between 3.5 and 7 billion dollars once chronic under-reporting is taken into account. For small and medium businesses, business email compromise remains the single costliest type of incident.

Ransomware still looms large

None of this means ransomware has faded away. It remains the top cybercrime threat facing Canada's critical infrastructure, and incidents continue to rise across most sectors year after year. There is, however, a note of defiance in the data, as 88 percent of Canadian businesses hit by ransomware chose not to pay the demanded ransom, even as attackers refine their extortion tactics.

A threat actor with Canada in its sights

Some adversaries are taking direct aim at the country. Microsoft Threat Intelligence identified a group tracked as Storm-2755, which specifically targets Canadian users through malicious advertising and techniques designed to bypass even phishing-resistant multi-factor authentication. Its focus on widely used platforms such as Microsoft 365 and Workday shows how attackers hunt for the tools people rely on every day.

The industrial scale of phishing

Phishing, meanwhile, has become an industry of its own. Before it was disrupted, a single toolkit known as Tycoon 2FA accounted for roughly 62 percent of phishing attempts across major platforms. Even after that takedown, the total volume handled by the remaining kits actually rose, climbing from around 20 million to more than 23 million attempts, a reminder of how quickly the criminal ecosystem adapts.

The defence that actually works

There is genuine good news buried in the findings. The report notes that modern authentication methods such as FIDO2 and passkeys block more than 99 percent of identity attacks. In a landscape dominated by stolen credentials, that single statistic points to a practical and highly effective step organisations can take right now to protect themselves and their users.

The scale of the breaches

The regulatory record underlines just how widespread the problem has become. Canada's Privacy Commissioner received 686 breach reports under the federal privacy law, incidents that together affected roughly 20 million Canadian accounts. With overlapping federal, provincial and sector-specific rules imposing strict deadlines, organisations face not only the attack itself but a complex web of reporting obligations in its aftermath.

A growing push for data sovereignty

The report also captured a shift in how Canadian organisations choose their technology partners. Some 69 percent now prioritise data sovereignty when selecting vendors, up from 60 percent in 2024, while 56 percent have reconsidered relying on certain foreign providers. The trend reflects a broader desire to keep sensitive information closer to home and under clearer legal protection.

Taken together, the 2026 findings sketch a demanding but not hopeless picture. Attacks are faster, more focused on identity and more commercially organised than ever, yet the tools to blunt them, from passkeys to stronger reporting, already exist. The message for Canadian organisations is straightforward, treat identity as the front line, and act before the next intrusion arrives in a matter of seconds.