« All threats

Ransomware in Canada

In the last 12 months, 106 organisations in Canada have been claimed by ransomware groups, 28 of them in the last 30 days. The figures come from the groups' own leak sites and are not verified unless stated; many victims pay and never appear.

Victims, last 12 months106
Last 30 days28
Confirmed by press0

Explore with filters →🔔 Get alerts for Canada

Victims per month

  1. Nov 250
  2. Dec 250
  3. Jan 260
  4. Feb 260
  5. Mar 260
  6. Apr 2610
  7. May 2618
  8. Jun 2621
  9. Jul 2618
  10. Aug 269
  11. Sep 2630
  12. Oct 260

Most active groups (12 months)

  1. The Gentlemen17
  2. Storm8
  3. Qilin7
  4. Akira5
  5. Chaos5
  6. M3rx4
  7. Black Nevas4
  8. Safepay4
  9. Dragonforce4
  10. Cmd Organization3

Most affected sectors

  1. Manufacturing15
  2. Construction11
  3. Professional services11
  4. Healthcare9
  5. Transport & logistics7
  6. Government7
  7. Retail7
  8. Non-profit7
  9. Technology6
  10. Real estate5

Recent victims

OrganisationGroupSectorClaimedStatus
MCAPN0nFinance & insurance9/30/2026◌ Claimed (unverified)
ScanboKillsec3Healthcare9/27/2026◌ Claimed (unverified)
EllisDon CorporationMetaencryptorConstruction9/26/2026◌ Claimed (unverified)
Aldo GroupClopRetail9/23/2026◌ Claimed (unverified)
🔒 Organización (CA)ClopOther9/23/2026◌ Claimed (unverified)
Metalware CorporationThe GentlemenManufacturing9/21/2026◌ Claimed (unverified)
Manroc Developments Inc.StormManufacturing9/21/2026◌ Claimed (unverified)
XperaBrain CipherTechnology9/17/2026◌ Claimed (unverified)
Bee Maid Honey LimitedAkiraAgriculture & food9/16/2026◌ Claimed (unverified)
PharmasaveSpiralsHealthcare9/14/2026◌ Claimed (unverified)
Canadian Mental Health AssociationStormHealthcare9/13/2026◌ Claimed (unverified)
Metalware Corporation Inc.KrybitManufacturing9/12/2026◌ Claimed (unverified)
Air CanadaThe GentlemenTransport & logistics9/9/2026◌ Claimed (unverified)
COMPUTER COUNTRY AND NETWORKSBlack NevasTechnology9/9/2026◌ Claimed (unverified)
Westbrook Greenhouse SystemsBlack NevasManufacturing9/9/2026◌ Claimed (unverified)
Jack Rutherford Customs Brokers LtdBlack NevasTransport & logistics9/9/2026◌ Claimed (unverified)
Portable Intelligence IncBlack NevasTechnology9/9/2026◌ Claimed (unverified)
FlexmasterStormManufacturing9/9/2026◌ Claimed (unverified)
LowerysStormRetail9/9/2026◌ Claimed (unverified)
Tapper Cuddy LLPStormLegal9/9/2026◌ Claimed (unverified)
MelitronStormManufacturing9/9/2026◌ Claimed (unverified)
Petrocare ConstructionStormConstruction9/9/2026◌ Claimed (unverified)
Integra CastingsStormManufacturing9/9/2026◌ Claimed (unverified)
McNish SteelSafepayManufacturing9/8/2026◌ Claimed (unverified)
MSM UnifyKazuEducation9/7/2026◌ Claimed (unverified)
YocaleKazuTechnology9/7/2026◌ Claimed (unverified)
Commission de la construction du QuebecQilinGovernment9/4/2026◌ Claimed (unverified)
Multiver LtéeINC RansomOther9/2/2026◌ Claimed (unverified)
AlphaplantesKrybitProfessional services9/1/2026◌ Claimed (unverified)
Commission de la construction du QuebecQilinGovernment9/1/2026◌ Claimed (unverified)

Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.

Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.