According to a TVA Nouvelles report, two thirds of small and medium businesses in Quebec have already been hit by a cyberattack. The information concerns Quebec, Canada; the source does not specify the methodology, the period covered, or the organization behind the figure.
Key points
- Per the reported information, two thirds of Quebec SMBs have already experienced a cyberattack, with no stated methodology or time period.
- The source does not name any affected company or specify the type of attack; this is an aggregate finding, not a documented individual case.
- The figure confirms what we see in practice: an organization’s size is not a protection against IT security risk.
What we know about this finding
The source reports a high proportion of Quebec SMBs already affected by a cyberattack, without detailing the nature of the incidents, their scale, or how the figure was established.
The report does not describe a single incident with an identified victim: it presents an aggregate finding covering Quebec SMBs as a whole. Given the lack of methodological detail in the available excerpt, we limit ourselves to reporting the information as published, without amplifying it or adding precision beyond what the source supports.
This type of finding lines up with notices published by the Canadian Centre for Cyber Security, which regularly note that no organization, regardless of size, is immune to an IT security incident.
What this means for a Quebec SMB or nonprofit
For an SMB or nonprofit leader, this finding is not a reason to panic, but a reminder that the question is no longer “if” an incident will occur, but how prepared the organization is for it.
In Quebec, any organization that handles personal information is subject to the Act respecting the protection of personal information in the private sector, which requires, among other things, keeping a confidentiality incident register and, depending on the case, notifying the Commission d’accès à l’information (the provincial privacy regulator). These obligations exist independently of any specific incident: they apply to any organization covered by the law, whether or not it has already suffered an attack.
There is no absolute protection against cyberattacks, and no serious provider can promise zero risk. The realistic goal is to significantly reduce exposure and limit the consequences when an incident occurs, rather than seek a guarantee that does not exist.
FAQ
Does this “two thirds” figure apply to all SMBs, regardless of sector?
The source does not specify whether the figure varies by industry, exact company size, or region within Quebec. It is an overall finding reported by TVA Nouvelles, with no breakdown available in the excerpt consulted. We recommend consulting the original report for any further detail on the scope of this figure.
Is an SMB that has never had an incident at lower risk?
Not necessarily. The absence of a known incident can also reflect insufficient detection rather than genuine protection. The Canadian Centre for Cyber Security recommends baseline controls, such as tested backups and access management, that apply even without a reported incident.
What should a Quebec organization do if it suspects a breach of personal information?
It should assess the risk of harm to the individuals affected, log the event in its confidentiality incident register, and determine whether notification to the Commission d’accès à l’information is required. These obligations stem from the applicable Quebec law, not from any specific incident reported in the media.
Sources
- TVA Nouvelles, via Google Actualités · press, 2026
- Commission d’accès à l’information du Québec · obligations, incident register and notification
- Canadian Centre for Cyber Security: Baseline Cyber Security Controls for Small and Medium Organizations · baseline control checklist
