Cybercrime costs Canadian companies millions even as awareness grows: report
Global News
Part of the reason the financial fallout from cybercrime continues to grow is that cybercriminals are getting more sophisticated, one expert said.
Increased corporate awareness and a string of high-profile incidents have done little to reduce the financial burden of cybercrime in Canada, according to a new report.
The average cost to companies of a cybersecurity breach in Canada as of 2023, according to an IBM survey of 26 victimized organizations, is $6.94 million – down slightly from last year’s $7.05 million but still the second-highest annual price tag in the study’s nine-year history.
As well, in addition to the technical, legal and public relations costs incurred by companies in the wake of an incident, the report shows organizations that fall prey to a cyberattack are spending a significant amount of time mopping up the damage.
According to IBM, it takes companies an average of 215 days to identify and contain a data breach. That means many corporations spend a good part of a year dealing with the fallout after a successful cyberattack.
“The reality is the clean-up process has a very long tail,” said Chris Sicard, security consulting and delivery leader for IBM Canada.
“Once you are dealing with an attack, and you are working to contain that breach – even though it’s not in the news cycle anymore – there is an awful lot of investment and work that is required to make sure it never happens again.”
The IBM report comes in the wake of a string of headline-grabbing incidents in Canada. Book retailer Indigo, grocer Sobeys, oil and gas producer Suncor Energy Inc. and Toronto’s Hospital for Sick Children have all publicly admitted to being victims of cybercrime over the past year.
According to the IBM report, cybercriminals – in particular, ransomware attackers – are most likely to go after companies and industries that have little to no tolerance for downtime, and that are most likely to pay a ransom quickly in order to get their systems back and up running as soon as possible.