Canada
CA #2 Most TargetedRansomware victim intelligence profile · Ranked #2 globally · Updated: Apr 4, 2026
Ransomware Threat Profile: Canada
Canada ranks #2 globally for ransomware attacks, with 716 confirmed victims in this database — representing 4.3% of the worldwide total. The most active ransomware groups targeting Canada include Qilin, Play, Akira.
The most frequently targeted industries in Canada are Business Services, Manufacturing, Technology. The healthcare sector is particularly vulnerable because attacks on hospitals and medical providers can create life-threatening situations, increasing pressure to pay ransoms quickly.
Canada's attack volume reflects broader trends in ransomware targeting: as one of the world's largest economies with extensive digital infrastructure, Canada presents a high-value target environment with many large organisations, diverse industries, and significant data assets that ransomware groups seek to exploit.
Organisations in Canada should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Canada (20 cached of 716 total)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | bunch.ca | Dragonforce | — | Apr 2, 2026 |
| 2 | CHEK News | Qilin | Telecommunication | Apr 1, 2026 |
| 3 | Service Star Freightways | Qilin | Transportation/Logistics | Mar 31, 2026 |
| 4 | Q2 Artificial Lift Services | Payload | Manufacturing | Mar 28, 2026 |
| 5 | Groupe Caddac | Thegentlemen | — | Mar 21, 2026 |
| 6 | briwaycarriers.com | Safepay | Transportation/Logistics | Mar 17, 2026 |
| 7 | mattandsteve.com | Safepay | — | Mar 17, 2026 |
| 8 | Solutions Extreme Technology | Ailock | Technology | Mar 17, 2026 |
| 9 | phoenixlabs.com | Dragonforce | Technology | Mar 13, 2026 |
| 10 | ControlGMC | Thegentlemen | Manufacturing | Mar 12, 2026 |
| 11 | Canada Goose | Coinbasecartel | Consumer Services | Mar 11, 2026 |
| 12 | Kuzco Lighting | Qilin | Consumer Services | Mar 7, 2026 |
| 13 | Eeyou Communications Network | Ailock | Telecommunication | Mar 7, 2026 |
| 14 | Select Tool | Play | Manufacturing | Mar 6, 2026 |
| 15 | Waterloo Information Systems | Qilin | Technology | Mar 6, 2026 |
| 16 | A Lococo Wholesale | Qilin | — | Mar 5, 2026 |
| 17 | Ecofit | Akira | — | Mar 5, 2026 |
| 18 | ripobec.com | Safepay | — | Mar 3, 2026 |
| 19 | Equine Canada | Play | — | Mar 3, 2026 |
| 20 | Labtician Ophthalmics | Thegentlemen | Healthcare | Mar 1, 2026 |
Frequently Asked Questions
How many ransomware attacks have occurred in Canada?
Canada has recorded 716 ransomware victim disclosures in this database, ranking #2 globally. This represents 4.3% of all tracked ransomware attacks worldwide.
Which ransomware groups target Canada?
The ransomware groups most active in Canada are Qilin, Play, Akira, Clop. These groups collectively account for the majority of victim disclosures attributed to Canada.
Which industries are most targeted by ransomware in Canada?
In Canada, the most frequently targeted sectors are Business Services, Manufacturing, Technology. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Canada rank globally for ransomware attacks?
Canada ranks #2 globally for ransomware attacks with 716 victim disclosures, representing 4.3% of the worldwide total of 16,710 tracked victims.
How can organisations in Canada protect against ransomware?
Organisations in Canada should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Canada is also recommended.