Canada's national cyber agency says ransomware will remain a major threat for years to come. We break down the key findings on the risks, the tactics, and the defences that help.
Ransomware has become one of the most disruptive cyber threats facing organisations today, and Canada is no exception. A recent outlook from the country's national cyber agency sets out what individuals, businesses and public bodies can expect over the coming years. For anyone who relies on digital systems, which is almost everyone, the findings are a useful and sobering guide to a risk that is not going away any time soon.
A threat that is here to stay
The central message is clear and direct. According to the Canadian Centre for Cyber Security, ransomware will remain a significant threat to Canada over the next two years. The agency notes that the criminals behind these attacks are almost always opportunistic and financially motivated, seeking the easiest possible route to a payout. That combination of persistence and profit motive helps explain why the problem has proved so difficult to stamp out.
The numbers behind the threat
The scale of the issue is reflected in the data. According to the Cyber Centre, ransomware incidents in Canada rose by about 26 percent year over year between 2021 and 2024, while in 2023 some 13 percent of Canadian businesses reporting a cyber incident pointed to ransomware. The financial toll is striking too, with recovery costs said to have doubled to around 1.2 billion Canadian dollars in 2023 alone, underlining the heavy price of these attacks.
A rare piece of good news
Not all of the report is grim, however. According to the Cyber Centre, the agency issued 336 pre ransomware notifications during 2024 and 2025, warning potential victims before an attack could fully unfold. Those timely alerts are estimated to have saved around 18 million Canadian dollars, a reminder that early detection and cooperation between defenders can blunt the impact of even a fast moving threat when they work as intended.
How new technology changes the game
One of the most significant shifts involves the tools now available to attackers. According to the Cyber Centre, cybercriminals are using artificial intelligence across various stages of ransomware attacks, from developing malicious software and generating deepfakes to automating negotiations with victims, researching vulnerabilities and crafting social engineering schemes. This lowers the barrier to entry, allowing less skilled criminals to launch more convincing campaigns.
The rise of double extortion
Ransomware tactics have also grown nastier over time. According to the Cyber Centre, a group known as Maze pioneered so called double extortion in 2019 by publicly releasing victim data when ransom demands went unpaid. The approach has since become widespread, with attackers stealing sensitive files before locking them, then threatening to publish the data. In effect, a victim's reputation becomes a second hostage alongside their systems.
No sector is safe
While some targets are more tempting than others, none can afford to feel immune. According to the Cyber Centre, critical infrastructure and large corporations remain attractive to attackers, yet no sector is exempt from the threat. Organisations in manufacturing, telecommunications, information technology, professional services and healthcare have all been affected, showing how broadly the danger now reaches across the economy and public life.
The names behind the attacks
The report also identifies some of the most active threats. According to the Cyber Centre, the leading ransomware operations affecting Canada in 2024 included Akira, associated with attacks on manufacturing and telecommunications, and Play, linked to information technology and professional services through double extortion. Another named group, Medusa, was noted for targeting critical infrastructure, a particularly sensitive area of concern for the country.
Simple defences that make a difference
Fortunately, the guidance also points to practical steps that reduce risk. According to the Cyber Centre, keeping software up to date with regular and automatic patches is a basic but powerful measure, as is enabling multi factor authentication on accounts. Maintaining routine backups of important data is equally vital, ensuring that even if files are locked, an organisation has a way to restore its systems without paying a ransom.
People as the first line of defence
Technology alone is not enough, since many attacks begin with a single human mistake. According to the Cyber Centre, training employees to recognise threats is a key defence, along with raising awareness of phishing and encouraging people to validate suspicious links and emails before acting. A well informed workforce can stop many attacks at the very first step, long before malicious software ever reaches critical systems.
Planning before an incident
Finally, the agency stresses the value of preparation. According to the Cyber Centre, having an incident response plan in place allows an organisation to react quickly and calmly when something goes wrong, rather than improvising under pressure. Knowing in advance who does what, how to isolate affected systems and how to communicate can make the difference between a manageable disruption and a full blown crisis for any organisation.
Staying one step ahead
Taken together, the outlook paints a picture of a threat that is evolving quickly but is far from unbeatable. The tactics may be growing more sophisticated, yet many of the most effective defences remain refreshingly straightforward and within reach of most organisations. By combining strong basic habits with awareness and planning, Canadians can meet a serious risk with a measured and confident response rather than fear.
Keep subscribing to Noah MitchellHer next filing reaches you the moment it publishes, on her own subdomain.
Subscribe