CONFIRMED RANSOMWARE ATTACKS · COUNTRY
Ransomnews has confirmed 356 ransomware attacks in Canada between January 2018 and September 2026, each one verified against a public source such as a breach notification, regulatory filing, court record or press report. That is 3.7% of the 9,715 confirmed incidents in the dataset. So far in 2026, 18 have been confirmed, against 30 in 2025 and 36 in 2024. The most affected sector is government, with 61 confirmed victims (17%). Toronto is the city with the most confirmed victims, at 28. Where the operator is attributed, Conti leads with 20 confirmed victims. A ransom payment is on the public record in 17 cases and a refusal in 75; the outcome is unrecorded in the remaining 264.
Confirmed ransomware attacks in Canada by year
The current year is a partial count. Confirmation lags the attack itself, so recent months keep filling in after the fact; read a low figure for the latest year as incomplete rather than as a decline.
| Year | Confirmed attacks | Ransom paid (public) | Ransom refused (public) |
|---|---|---|---|
| 2018 | 14 | 6 | 3 |
| 2019 | 20 | 2 | 11 |
| 2020 | 90 | 3 | 18 |
| 2021 | 70 | 1 | 9 |
| 2022 | 31 | 2 | 9 |
| 2023 | 47 | 1 | 9 |
| 2024 | 36 | 0 | 11 |
| 2025 | 30 | 2 | 4 |
| 2026 (year to date) | 18 | 0 | 1 |
Which ransomware groups attack organisations in Canada most
The operator is attributed in 230 of the 356 confirmed incidents. Counts are confirmed victims, not leak-site claims, so they run well below the totals the groups publish about themselves. Group names link to the live Ransomtracker profile where one exists.
Most active groups by confirmed victims
Where the confirmed attacks in Canada fall
Most affected sectors
Cities with the most confirmed victims
Ransom payment outcomes in Canada
Among the 92 confirmed incidents in Canada where the outcome is on the public record, 17 paid and 75 refused, a disclosed payment rate of 18.5%. The remaining 264 carry no public statement either way. Victims that pay have every incentive to stay quiet and public bodies are the most likely to announce a refusal, so treat this as the disclosed rate, not the true one. The ransomware payment rate analysis explains how the disclosed rate has moved since 2018 and how it compares with incident-response firm samples.
Largest confirmed ransomware attacks in Canada by records exposed
Record counts are recorded only where a named source disclosed them, which is the minority of cases, so this table ranks disclosed impact rather than true impact.
| Date | Organisation | Sector | Location | Records | Group | Ransom paid | Source |
|---|---|---|---|---|---|---|---|
| October 2019 | LifeLabs Medical Laboratory Services | Healthcare | Etobicoke, Canada | 15,000,000 | — | Yes | techmonitor.ai |
| July 2023 | Alberta Dental Service Corporation | Healthcare | Edmonton, Canada | 1,470,000 | 8Base | Yes | siliconangle.com |
| June 2025 | WestJet | Transportation | Calgary, Canada | 1,200,000 | — | Unknown | kvkk.gov.tr |
| July 2024 | Park'N Fly | Service | Mississauga, Canada | 1,000,000 | RansomHub | Unknown | bleepingcomputer.com |
| December 2019 | eHealth Saskatchewan | Government | Regina, Canada | 547,145 | Ryuk | No | globalnews.ca |
| April 2025 | Nova Scotia Power | Utilities | Halifax, Canada | 280,000 | — | No | cbc.ca |
| October 2023 | TransForm Shared Service Organization (Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, Windsor Regional Hospital) | Healthcare | Ontario, Canada | 270,198 | Daixin | No | transformsso.ca |
| October 2020 | SE Canada, Inc. (Service Experts) | Service | Mississauga, Canada | 225,176 | — | Unknown | oipc.ab.ca |
| March 2025 | Ontario Medical Supply (OMS) | Healthcare | Ottawa, Canada | 200,000 | — | Yes | globalnews.ca |
| November 2022 | Sobeys | Food and Beverage | Stellarton, Canada | 172,872 | Black Basta | Unknown | blogto.com |
Most recent confirmed ransomware attacks in Canada
The 25 most recently confirmed of 356 incidents, newest first. Every row links to the public source it was verified against.
| Date | Organisation | Sector | Location | Records | Group | Ransom paid | Source |
|---|---|---|---|---|---|---|---|
| September 2026 | Lakewood Medical Centre | Healthcare | Winnipeg, Canada | — | Booba Project | Unknown | lakewoodmedical.ca |
| September 2026 | Nipigon District Memorial Hospital | Healthcare | Nipigon, Canada | — | Storm | No | facebook.com |
| August 2026 | Commission de la construction du Québec | Government | Quebec, Canada | — | Qilin | Unknown | ccq.org |
| August 2026 | Health Science Centre (Winnipeg) | Healthcare | Winnipeg, Canada | — | — | Unknown | cbc.ca |
| July 2026 | Neopharm Labs Inc. | Healthcare | Blainville, Canada | — | Chaos | Unknown | mass.gov |
| July 2026 | Loyalist College | Education | Belleville, Canada | — | INC | Unknown | loyalistcollege.com |
| June 2026 | X-Copper Professional Corporation | Legal | Markham, Canada | — | Money Message | Unknown | toronto.citynews.ca |
| June 2026 | Sleeman Breweries Ltd. | Food and Beverage | Guelph, Canada | — | Chaos | Unknown | facebook.com |
| June 2026 | Mount Royal University | Education | Calgary, Canada | — | CMD Organization | Unknown | emergency.mtroyal.ca |
| June 2026 | Klue | Technology | Vancouver, Canada | — | ICARUS | Unknown | infosecurity-magazine.com |
| May 2026 | Bath Fitter | Retail | Quebec, Canada | 3,590 | Anubis | Unknown | ago.vermont.gov |
| April 2026 | Rural Municipality of Gimli | Government | Gimli, Canada | — | Payload | Unknown | ctvnews.ca |
| April 2026 | STELIA Aerospace North America Inc. | Manufacturing | Lunenburg, Canada | — | Rhysida | Unknown | aviationbusinessnews.com |
| March 2026 | CarePoint Health | Healthcare | Mississauga, Canada | — | Genesis | Unknown | carepointhealth.ca |
| March 2026 | Westport Fuel Systems Inc. | Manufacturing | Vancouver, Canada | — | Embargo | Unknown | s26.q4cdn.com |
| February 2026 | CHOC FM 88.7 | Other | Pont-Rouge, Canada | — | — | Unknown | ici.radio-canada.ca |
| January 2026 | Ardene Holdings Inc. | Retail | Laval, Canada | — | Akira | Unknown | ctvnews.ca |
| January 2026 | Lakelands Public Health | Healthcare | Peterborough, Canada | 60,000 | Lynx | Unknown | lakelandsph.ca |
| December 2025 | Microforum Services Group | Manufacturing | Toronto, Canada | — | Akira | Unknown | mm.nh.gov |
| December 2025 | Leduc County | Government | Nisku, Canada | — | — | Unknown | leduc-county.com |
| December 2025 | Eastern Townships School Board | Education | Magog, Canada | — | Qilin | Unknown | cjmqnews.com |
| November 2025 | Kelsey School Division | Education | The Pas, Canada | — | Ransomware Blog/MedusaLocker | Unknown | kelseyschooldivision.ca |
| November 2025 | BioPharma Services Inc. | Healthcare | Toronto, Canada | — | Qilin | Unknown | biopharmaservices.com |
| October 2025 | Collège Supérieur de Montréal | Education | Montreal, Canada | — | Rhysida | Unknown | facebook.com |
| October 2025 | Ville de Mont-Laurier | Government | Mont-Laurier, Canada | — | Qilin | Unknown | villemontlaurier.qc.ca |
Frequently asked questions
How many ransomware attacks in Canada have been confirmed?
Ransomnews has confirmed 356 ransomware attacks in Canada since January 2018, including 18 so far in 2026. Each one is verified against a public source such as a breach notification, regulatory filing or press report. The true total is higher, because many victims never disclose; confirmed counts are a floor, not a ceiling.
Which ransomware group is most active in Canada?
Conti, with 20 confirmed victims, followed by Netwalker (17) and LockBit (15). These are confirmed victims, not leak-site claims, counted among the 230 incidents where the operator is attributed.
Which sector is hit most by ransomware in Canada?
Government, with 61 confirmed incidents (17% of the total). Healthcare follows with 44, then Education with 31.
Which cities in Canada have the most confirmed ransomware attacks?
Toronto (28), Quebec (26), Calgary (24), Ontario (24), Montreal (23). City is recorded where the victim organisation is headquartered or the incident was reported, so distributed organisations are counted once.
How often do ransomware victims in Canada pay the ransom?
Among the 92 confirmed incidents in Canada with a public outcome, 17 paid and 75 refused, a disclosed payment rate of 18.5%. Most victims never state whether they paid, and those who pay have the least reason to say so, so the disclosed rate understates real payment behaviour. The payment rate analysis tracks this figure since 2018.
What is the largest confirmed Canada ransomware attack by records exposed?
LifeLabs Medical Laboratory Services (Etobicoke, Canada, October 2019), with 15,000,000 records exposed according to techmonitor.ai. Record counts exist only where a source disclosed them, so this ranks disclosed impact.
How to read this page. Every incident counted here was verified by Ransomnews against at least one public source. Leak-site listings alone do not qualify, because operators inflate, duplicate and occasionally fabricate claims, so these totals are a defensible floor rather than a full census. Records exposed and ransom outcomes appear only where a named source disclosed them. The page is regenerated from the live database, which refreshes weekly. Cite as: Ransomnews Confirmed Ransomware Attacks Dataset, ransomnews.com, with a link to this page. Bulk access and methodology questions: [email protected]. See also the monthly ransomware statistics and the Ransomtracker.