
Nearly two-thirds (65%) of Canadian companies that suffered a cyberattack in the past 12 months indicate a supplier was involved, according to research from business insurer QBE. That’s up from 58% last year.
In Canada, 57% of businesses experienced one or more cyber events over the past 12 months, slightly higher than last year (53%), QBE Canada says in a press release Tuesday. Among affected businesses, 65% suffered at least one cyberattack that was related to a supplier and 58% experienced revenue loss (up from 51%).
For the study, market research firm Opinium surveyed 400 decision-makers handling IT, administration or insurance at businesses with between 100 and 2,000 employees in Canada. The survey was fielded from March 31 to April 20, 2026. The 2026 global survey covered 15 countries, with a total sample of more than 6,000 businesses.
Canadian Underwriter has heard cyberattacks involving suppliers have been increasing. At the Insurance Brokers Association of Alberta (IBAA) Convention 2026 last week, BOXX Insurance president Jonathan Weekes anticipated this trend would continue. Supply chain or infrastructure-related breaches will increase in Canada as organizations shift toward cloud-based solutions or standardized software platforms to run their business, he says.
And, at its 2025 Insurance Conference in Toronto last November, KPMG said it was seeing more ‘hybrid’ cyberattacks targeting both first and third parties.
Cyber insurance take-up increases
The good news from a cyber insurance perspective is that more Canadian businesses are purchasing cyber coverages. Seventy-two percent now have cyber insurance, compared to 67% last year.
QBE also reports Canadian businesses are taking various steps to safely roll out artificial intelligence (AI) within their operations, from training staff on responsible AI use, to checking data quality or monitoring outputs for bias. However, these businesses worry their vendors might not be taking similar measures. Indeed, 63% of Canadian businesses are concerned about potential risks arising from how their suppliers use AI.
“AI risk doesn’t stop at the internal perimeter,” Kyle Gray, underwriter team lead at QBE Canada, says in the release. “Organizations need the same level of discipline and oversight across their third-party ecosystem, because weaknesses in the supply chain can quickly become risks to the business itself.”
To mitigate third-party vulnerabilities, QBE suggests businesses should:
- Implement strong identity and access management (IAM) protocols, which control who can access technology resources and what they’re allowed to do once granted access
- Run regular configuration audits
- Encrypt sensitive data across all cloud environments
- Evaluate the security posture of third-party providers
- Establish clear protocols for managing supply chain exposure.
Emerging AI threat
According to QBE’s research, one in three Canadian businesses (33%) also experienced cyber incidents in the past 12 months that they believed leveraged AI, with phishing among the most frequent methods.
And 16% of polled Canadian businesses experienced a cyber event in the last 12 months that resulted in business interruption of one working day or more (down from 18% in last year’s study).
The research found two in three respondents (65%) are concerned about cyber threats their business may experience over the next 12 months, a smaller proportion than last year (78%), but still prompting investment.
Most Canadian businesses say their IT cybersecurity budget is going to increase over the coming year (31% say these investments will be in line with inflation and 31% say it will exceed the inflation rate). More than eight in 10 (83%) have an incident response plan, up from 79% in last-year’s survey.
AI is becoming ubiquitous in the Canadian economy, with 97% of businesses using it (83%) in 2026 or looking into using it (14%), up from 94% last year.
Increasing operational efficiency and productivity are among the top motivations for deploying AI, with more than half of businesses rolling out the technology mentioning these objectives.
“As new technologies such as AI become embedded in operations, effective risk management remains fundamental to ensuring sustainable and resilient growth,” Gray says.








