Small business cyber insurance in Ontario pays for the costs a cyber incident leaves behind, such as forensic investigation, notifying affected customers, restoring data, cyber extortion, and legal claims from a privacy breach. Statistics Canada’s 2025 data, released October 21, 2026, shows 34% of Canadian businesses with 10 or more employees now carry cyber risk insurance, but only 6% of insured businesses hit by an incident attempted a claim. Buying a policy is half the job; knowing what it covers and when to call your insurer is the other half.
October is Cyber Security Awareness Month in Canada, and the federal government’s 2026 theme is “Your best defence is you.” This guide uses the new Statistics Canada figures and federal guidance to answer the questions Ontario business owners ask most about cyber coverage. It is general information, not advice on any specific policy.
What did Statistics Canada’s 2025 cybercrime survey find?
Statistics Canada surveyed businesses with 10 or more employees between January and March 2026 about incidents in 2025. One in six (16%) was affected by a cyber security incident, unchanged from 2023. Small businesses (10 to 49 employees) were affected at 15%, close to medium businesses at 21%.
| Measure (Canadian businesses) | 2023 | 2025 |
|---|---|---|
| Affected by a cyber security incident | 16% | 16% |
| Affected businesses hit by scams and fraud | 50% | 55% |
| Affected businesses reporting ransomware | 13% | 8% |
| Businesses with cyber risk insurance | 22% | 34% |
| Insured, affected businesses that attempted a claim | 9% | 6% |
| Affected businesses that reported to police | 13% | 11% |
| Average spending on prevention measures | $53,907 | $54,772 |
Source: Statistics Canada, Impact of cybercrime on Canadian businesses, 2025 (The Daily, October 21, 2026).
Three points stand out for small business owners:
- Scams and fraud now dominate. They were involved in 55% of incidents at affected businesses, up from 44% in 2021. Ransomware fell to 8%.
- Insurance uptake is rising, but unevenly. 63% of large businesses had cyber risk insurance, against 34% of all businesses. Statistics Canada did not publish a small business figure in this release.
- Very few insured businesses claimed. The release does not explain why. Possible reasons include incidents falling below the deductible, being resolved internally, or not being covered, but the data doesn’t say.
The survey excludes businesses with fewer than 10 employees, so sole proprietors and micro-businesses aren’t captured. A separate Insurance Bureau of Canada (IBC) survey of firms with up to 500 employees, run in August 2025, found 22% carried cyber insurance and only 12% had a dedicated stand-alone policy.
Does my general liability or property policy already cover cyber attacks?
Usually not in any meaningful way. The federal Get Cyber Safe program notes that “most property or liability policies don’t clearly cover cyber risks,” which is why many businesses need a separate cyber policy. IBC’s small business cyber guide adds that traditional property and liability policies may include limited cyber coverage with low limits, and that endorsements can add, remove or exclude cyber coverage.
A commercial general liability policy is mainly built around bodily injury and property damage to others, not your own data, systems or breach costs. If you’re unsure what your current package includes, our overview of what business insurance covers explains how the main policies fit together. This article covers the cyber piece in detail.
What does small business cyber insurance in Ontario cover?
Wording varies from insurer to insurer, so treat this as a checklist to compare quotes, not a promise of coverage. IBC and the Government of Canada describe these as the main areas a cyber policy can address:
| Coverage area | What it can pay for |
|---|---|
| Breach response | Notifying affected customers and offering credit monitoring |
| Forensic investigation | Hiring specialists to find the cause and scope of a breach |
| Data restoration | Restoring or recovering damaged or corrupted data |
| Cyber extortion | Responding to demands backed by threats to your data, such as ransomware |
| Technology disruption | Incidents such as technology failure or denial-of-service attacks; ask whether lost income is included |
| Privacy and network security liability | Legal defence costs and civil damages if customers or partners sue after a breach |
Two details matter when comparing quotes. First, IBC notes that the limits on add-on cyber coverage may not cover the full cost of a breach. Second, IBC describes a stand-alone policy as the most comprehensive option currently available in Canada. Our cyber liability insurance page outlines the options we can place.
Does small business cyber insurance in Ontario cover scams and fraud?
It depends on the policy, and this is the question most worth asking. With scams and fraud involved in 55% of incidents, the most likely loss for a small business is a convincing fake invoice, a spoofed supplier email asking you to change banking details, or an impersonated executive requesting an urgent transfer.
Neither IBC’s guide nor the Get Cyber Safe guidance says that a standard cyber policy covers money you were tricked into sending. Depending on the insurer, this kind of loss may sit in the cyber policy, in a separate crime policy, or nowhere at all; the wording decides. Before you buy, ask your broker three things:
- Is social engineering or funds transfer fraud covered, and under which policy?
- Is there a separate, lower limit for it?
- Does the policy require a verification step, such as a call-back to a known number, before a payment change?
Whatever the answer, a call-back rule for any change in payment details is a cheap control that protects you either way.
What must an Ontario business do after a data breach?
Most private-sector businesses in Ontario that handle personal information in commercial activity fall under the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Only Alberta, British Columbia and Quebec have general private-sector privacy laws deemed substantially similar. Under PIPEDA, if it is reasonable to believe a breach creates a “real risk of significant harm,” you must:
- Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible after you determine it happened.
- Notify affected individuals directly, also as soon as feasible.
- Notify other organizations that can reduce the harm, such as law enforcement or a payment processor.
- Keep a record of every breach, including ones below the threshold, for two years.
Knowingly failing to report, notify or keep records is an offence under section 28 of PIPEDA, with fines of up to $10,000 on summary conviction and up to $100,000 on indictment.
Health care providers are different. Personal health information in Ontario falls under the Personal Health Information Protection Act (PHIPA). Health information custodians, such as clinics, also report annual breach statistics to the Information and Privacy Commissioner of Ontario by March 1 each year. If you run a clinic, confirm your obligations with the IPC and your legal adviser.
The breach response costs that cyber insurance can cover, such as forensic work, notification and credit monitoring, are the same steps these rules push you to take quickly.
Why do so few insured businesses make a cyber claim?
Statistics Canada’s 6% figure is a warning for anyone who assumes coverage kicks in on its own. A claim usually starts with a phone call, and the earlier you make it, the more help you are likely to get. IBC’s guide notes that insurers may connect you with approved forensic teams and keep lists of trusted service providers.
When something goes wrong:
- Call your insurer or broker first, before hiring your own vendors, so the insurer can connect you with its approved response team and you can check what the policy requires. Report through our claims page if AAXEL placed your policy.
- Change passwords and secure affected accounts, as IBC recommends.
- Work out what data was affected so you can assess the PIPEDA threshold.
- Report the crime. The RCMP and Canadian Anti-Fraud Centre’s national Report Cybercrime and Fraud system accepts reports from businesses. You should still contact local police as well.
What do insurers ask before quoting small business cyber insurance in Ontario?
Expect an application that asks about your security habits. IBC lists typical questions: written privacy and security plans, recent security audits, staff training, physical access controls, access controls for IT systems, and encryption, antivirus and firewalls.
The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations are a practical way to prepare. They include:
- A written incident response plan, with a printed copy
- Automatic patching and anti-malware
- Two-factor authentication wherever possible, and always for remote access and cloud admin accounts
- Regular backups that you test, with long-term backups stored offline
- Security awareness training for employees
The same guidance tells organizations to “consider purchasing a cyber security insurance policy” as part of incident response. Insurance supports these controls; it doesn’t replace them.
Choosing small business cyber insurance in Ontario with a broker
Cyber policies are less standardized than auto or home insurance, so side-by-side comparison matters. An independent broker can compare wording, limits and exclusions across the insurers it represents and flag gaps such as funds transfer fraud. [ORGANISATIONAL OBSERVATION: AAXEL to confirm or replace, e.g. “The question our commercial brokers hear most often is…”]
Cyber cover is one part of a wider commercial program, and the cost depends on your revenue, the data you hold and your controls. Our guide to what affects business insurance costs in Ontario explains the general factors, and our small and medium business insurance page shows how coverages can be bundled.
Ready to check your exposure? Request a commercial quote and a licensed AAXEL broker will review your current policies for cyber gaps.
FAQ
What is cyber insurance for a small business? It is a policy that pays for costs after a cyber incident, such as a data breach or ransomware attack. Depending on the wording, that can include forensic investigation, notifying customers, credit monitoring, data restoration, cyber extortion and legal claims. A stand-alone policy is usually broader than cyber cover added to a property or liability policy.
Does a commercial general liability policy cover cyber attacks? Not clearly. The Government of Canada’s Get Cyber Safe program says most property or liability policies don’t clearly cover cyber risks. Any cyber cover in a traditional package tends to have low limits, so check your wording with your broker.
How many Canadian businesses have cyber insurance? Statistics Canada reports that 34% of businesses with 10 or more employees had cyber risk insurance in 2025, up from 22% in 2023. Among large businesses the figure was 63%.
Does cyber insurance cover phishing scams and fake invoices? Not automatically. Money sent after a fraudulent request may be covered under a cyber policy, a crime policy, or neither, depending on the insurer. Ask whether social engineering or funds transfer fraud is covered and at what limit.
Does cyber insurance pay for ransomware? Many cyber policies include cyber extortion cover for demands backed by threats to your data, subject to the policy terms. Statistics Canada found ransomware affected 8% of businesses hit by an incident in 2025, down from 13% in 2023.
Do I have to report a data breach in Ontario? If your business is covered by PIPEDA and a breach creates a real risk of significant harm, you must report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. You must keep a record of every breach for two years, whether or not it is reportable.
What are the penalties for not reporting a breach under PIPEDA? Knowingly failing to report, notify or keep breach records is an offence under section 28 of PIPEDA. Fines can reach $10,000 on summary conviction and $100,000 on indictment.
Where do I report cybercrime or fraud in Canada? Businesses can report through the national Report Cybercrime and Fraud system run by the RCMP and the Canadian Anti-Fraud Centre. You should also contact local police and, if you are insured, your insurer or broker.
What do insurers ask before offering cyber insurance? Applications typically ask about written privacy and security plans, recent audits, staff training, access controls, encryption, antivirus and firewalls. Following the Canadian Centre for Cyber Security’s baseline controls, such as two-factor authentication and tested offline backups, helps you answer well.
How much does small business cyber insurance cost in Ontario? There is no published standard rate. Premiums depend on factors such as your revenue, industry, the amount of personal data you hold and your security controls. A broker can compare quotes from several insurers.
Why should I tell my insurer about a cyber incident quickly? Insurers can connect you with approved forensic teams and service providers, and your policy sets out how and when to give notice. Statistics Canada found only 6% of insured businesses hit by an incident attempted a claim in 2025. The data doesn’t say why, but a policy can only help if you use it.
Sources
All pages were opened and read on October 21, 2026.
- Statistics Canada, The Daily: Impact of cybercrime on Canadian businesses, 2025 (released October 21, 2026): all 2023/2025 survey figures, business-size definitions, survey scope (10+ employees, collected January to March 2026).
- Statistics Canada, The Daily: Impact of cybercrime on Canadian businesses, 2023: earlier baseline (used for cross-checking 2023 values).
- Communications Security Establishment / Canadian Centre for Cyber Security: Cyber Security Awareness Month 2026: October campaign and 2026 theme.
- Get Cyber Safe (Government of Canada): How cyber insurance can help reduce the online risks of businesses of all sizes: what cyber insurance covers; property/liability policies don’t clearly cover cyber.
- Insurance Bureau of Canada: Cyber Savvy small business guide (PDF): policy types, covered events and costs, application questions, incident steps, insurer forensic panels.
- Insurance Bureau of Canada: Canadian small businesses are underprepared for cyber attacks, survey shows (October 1, 2025): 22% carry cyber insurance, 12% stand-alone.
- Office of the Privacy Commissioner of Canada: What you need to know about mandatory reporting of breaches of security safeguards: RROSH threshold, notification, two-year records.
- Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (Justice Laws): sections 10.1, 10.3 and 28 (fine amounts).
- OPC: Provincial laws that may apply instead of PIPEDA: only Alberta, B.C. and Quebec have substantially similar general laws; Ontario’s PHIPA covers health information.
- Information and Privacy Commissioner of Ontario: Annual reporting of health privacy breach statistics: March 1 annual statistics deadline for health information custodians.
- RCMP: New national cybercrime and fraud reporting system (November 6, 2025): Report Cybercrime and Fraud system, open to businesses, co-run with the Canadian Anti-Fraud Centre.
- Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations: controls list and the recommendation to consider cyber insurance (BC.1.3).
Disclaimer
This article is general information about cyber insurance and privacy obligations for Ontario businesses as of October 2026. It is not legal advice or a statement of coverage under any policy. Coverage depends on the wording, limits, deductibles and exclusions of your own policy. For legal obligations after a breach, speak to a lawyer or the Office of the Privacy Commissioner of Canada; for coverage questions, speak to a licensed insurance broker.
