CSE annual report says Cyber Centre handled more than 3,200 incidents
The Canadian Centre for Cyber Security responded to more than 3,200 incidents affecting federal institutions and critical infrastructure between April 2025 and March 2026, the Communications Security Establishment said in its 2025-26 annual report, released June 29.
The report is the main public accounting of what Canada's signals intelligence and cyber defence agency does with its growing budget. This year it also describes direct action against ransomware groups, a sign that CSE's foreign cyber operations powers are being used against criminal as well as state threats.
Key figures
According to CSE, in 2025-26 the agency:
- produced 3,976 foreign intelligence reports;
- responded to more than 3,200 cyber incidents;
- issued 25 alerts and 995 advisories, plus more than 97,000 alerts through its National Cyber Threat Notification System to 1,363 subscribed organizations;
- took action against 10 of the most significant ransomware groups;
- completed 1,772 supply chain risk assessments; and
- operated under 13 ministerial authorizations, including four related to foreign cyber operations.
CSE's workforce grew 8.1 per cent to 4,178 employees. The agency said it is investing in cyber defence, AI and post-quantum cryptography with recent defence funding. Law360 Canada highlighted the nearly 4,000 intelligence reports and 97,000 alerts in its coverage.
Why it matters
The notification system figure matters most to Canadian organizations. The Cyber Centre sends these alerts when it sees signs that a specific organization's systems are compromised or exposed. With more than 97,000 sent to just over 1,300 subscribers, many organizations are receiving several warnings a year about their own infrastructure.
The ransomware actions are described only in general terms. CSE does not usually disclose targets or methods of its active and defensive cyber operations, which are authorized by ministerial authorization and reviewed by oversight bodies.
CSE also restated that its foreign intelligence and cyber operations do not target Canadians anywhere in the world or any person in Canada. The agency marks its 80th year in 2026.
What to do
- Critical infrastructure operators that do not yet receive Cyber Centre notifications can contact the centre to register.
- Report incidents to the Cyber Centre through its online portal; reports feed the alerts other organizations receive.
