Data tracker

Canadian breach tracker

Data breaches and cyber incidents at Canadian organizations, each checked against the organization's own notice, a regulator or a named news report. Select an organization for the details and the sources.

Last updated October 31, 2026 · How we keep this tracker

12breaches trackedDisclosed by Canadian organizations
31Mpeople affectedWhere disclosed; 7 did not say
Ransomwaremost common causeWhere the cause is known
Governmentmost affected sectorBy number of breaches

Canadian data breaches, newest first
Disclosed Sort ascending	Organization	Sector	Where	People affected	Cause	Status
Oct 21, 2026	Crime Stoppers leak	Government	Across Canada	Not disclosed	Supplier or third party	Confirmed
Jan 7, 2025	PowerSchool breach at Canadian school boards	Education	Across Canada	Not disclosed	Supplier or third party	People notified
Aug 15, 2020	GCKey and CRA accounts taken over by credential stuffing	Government	Across Canada	9,041	Stolen credentials	Resolved

How we keep this tracker

What we include

Breaches and cyber incidents at organizations in Canada, or affecting people in Canada, that have been made public. Each record links to its sources: the organization's notice, a privacy commissioner or regulator, or a news report we can name. Numbers come from those sources; when none was disclosed, we say so.

What we leave out

Claims that only appear on criminal leak sites, data that was stolen and published, and the names of people affected. We never link to leaked data.

What the statuses mean

Under investigationThe organization has reported an incident and is still finding out what was affected.
ConfirmedThe organization has confirmed that personal or business data was accessed or taken.
People notifiedThe organization has told the people affected, as Canadian privacy law requires.
ResolvedThe investigation is closed, or a regulator has published its findings.

Know of a breach we missed, or see something wrong? Tell us, with a link to the notice. We correct errors openly: see our corrections policy.