Steal First, Encrypt Later: How Ransomware Is Reshaping the Threat to Canadian Business

Ransomware has quietly become the defining cyber threat facing Canadian organizations, and the way it works has changed in ways that many businesses have yet to catch up with. The screen-locking attacks of the past are giving way to something colder and more calculated.

A threat at the top of the list

Canada's own security authorities are clear about the danger. The Canadian Centre for Cyber Security has named ransomware the top cybercrime threat to the country's critical infrastructure and its organizations more broadly through 2026.

The trend line is pointing the wrong way. Reporting on the sector indicates that ransomware incidents in Canada are rising overall and continue to increase year on year across most sectors, rather than levelling off as defenders had hoped.

The agency does not expect relief soon. In its outlook covering 2025 to 2027, the Cyber Centre is reported to warn that attackers will almost certainly escalate their extortion tactics and sharpen their methods over the next couple of years.

The playbook has changed

The most important shift is in how these attacks actually unfold. Modern ransomware is described as quieter and faster, far more interested in stealing an organization's data than in scrambling its desktops or defacing its screens.

That has flipped the old sequence on its head. Criminal crews now often steal files first and threaten to publish them, and only sometimes bother to encrypt the victim's systems at all, a tactic widely referred to as double extortion.

The named threats are specific rather than abstract. The Cyber Centre is reported to list groups known as Akira, Play and Medusa among the top ransomware-as-a-service operations currently menacing Canadian targets.

A rising bill for victims

The financial toll of all this is heavy. The average cost of a data breach in Canada is reported to have reached about 6.98 million Canadian dollars in 2025, a figure that captures far more than any single ransom payment.

That number reflects the true breadth of the damage. Breach costs fold in downtime, investigation, notification, lost business and reputational harm, expenses that can dwarf the ransom itself and linger long after systems are restored.

Small businesses in the firing line

It is not the largest corporations bearing the worst of it. Reporting indicates that mid-sized organizations, roughly those with 51 to 200 employees, are absorbing a large share of the attacks despite lacking the defences of bigger firms.

That mismatch is the heart of the problem. Small and medium businesses are said to soak up much of the impact while reporting the lowest baseline of security controls, leaving the most exposed organizations the least prepared to respond.

Preparing for the new normal

For Canadian firms the message is one of realism rather than panic. With attackers growing cheaper, faster and harder to detect, the sensible response is to assume data theft is the goal and to build defences and backups around that uncomfortable assumption.