According to information reported by Le Journal de Montréal, two thirds of Quebec small and medium businesses have already been hit by a cyberattack. The article specifies neither the methodology, nor the exact date, nor the source of this figure: we are relaying it as published, without elaboration.

Key points

  • Le Journal de Montréal reports that about two in three Quebec SMBs have already experienced a cyberattack, with no methodological detail available.
  • The source specifies neither the type of attack, nor the sector affected, nor the date of the incidents referenced in this overall finding.
  • This figure, imprecise as its details may be, aligns with the recurring findings of Canadian agencies on the exposure of small organizations.

What we know about this figure

The source gives an order of magnitude, not an incident file: no attack type, sector, or time period is specified. It should be read as an overall signal about Quebec, not as the account of a specific case.

The available excerpt does not allow us to identify a company, a precise location, or a specific attack. It is a statistical finding attributed to the press, covering Quebec SMBs as a whole, without breakdown by region, company size, or incident type (ransomware, phishing, email fraud, etc.). We also do not have access to the organization or study behind the figure cited by Le Journal de Montréal.

What this means for a Quebec SMB

Whether an overall figure is exact or approximate, the signal it sends remains the same: a small organization can no longer assume it is too small to interest an attacker. The question is no longer if, but when and how.

Attacks targeting small organizations rarely exploit a sophisticated flaw: instead they target missing backups, shared access without controls, or staff unprepared to recognize a fraudulent email. No provider can guarantee zero risk, but basic measures, documented by the Canadian Centre for Cyber Security, make these scenarios considerably harder to exploit.

FAQ

Is this two-thirds figure reliable?

We are relaying it as published by Le Journal de Montréal, without being able to verify the methodology or the exact source behind this finding. It should be read as an order of magnitude reported by the press, not as official data we have validated ourselves.

Must a cyberattack be reported to an authority in Quebec?

The Act respecting the protection of personal information in the private sector requires, in the event of a confidentiality incident affecting personal information, an incident log and, depending on the case, notification to the Commission d’accès à l’information (Quebec’s privacy regulator). These obligations exist independently of this specific figure and apply according to the nature of the incident experienced.

Where should we start if we have never assessed our exposure?

A simple inventory of access points, backups, and connected devices already gives a good picture of the most exposed angles. The Canadian Centre for Cyber Security offers a list of baseline controls designed for small organizations, useful as a starting point before going further.

Sources

Source: Le Journal de Montréal · https://news.google.com/rss/articles/CBMitAFBVV95cUxNUWNBdVRNWGk2eUxCZVV5LU5pNEJkaEcyRk9xX2xrVmpETUhqUjlKQkJkb29zNmlUa3liZ3JoRnBZb0ZnX203dW93TUFob2xPZjVFUHJvU19OZDU2VE1VTFRlMFM3bGtuRkp0WXVzbGdSWnBhRldaSVZHWTJwNWZpRW03enlTRjIzRzBlakRXbVNsN09xU1ozQ29nS2xEaW5qMHUwZElCdU9CRmN1N01wOGV3a1o?oc=5