Canada’s health care and social services sectors are facing an unprecedented cybersecurity crisis. According to a recent report by the Canadian Cybersecurity Network (CCN), along with Accerta and Darktrace, attacks on public systems are becoming more sophisticated and frequent. These breaches now threaten not just financial stability but also public trust, safety, and the resilience of essential services.
Elias Diab, vice president of cybersecurity at Accerta, warns, “Cybersecurity is no longer just a technical concern—it has become Canada’s new health care emergency.” With attacks on public systems increasing, the report emphasizes that the stakes go far beyond financial penalties, affecting the lives and dignity of citizens directly.
A Complex and Vulnerable Ecosystem
Canada’s health care and social services system is vast and interconnected, relying heavily on digital platforms to deliver programs supporting mental health, disability services, dental care, autism programs, and assistance for low-income populations. While digitisation improves access and efficiency, it also introduces vulnerabilities.
Government agencies face particular challenges due to legacy systems, budget constraints, and overlapping vulnerabilities across departments. Diab highlights that inter-jurisdictional data sharing creates a sprawling attack surface susceptible to disruption. This makes protecting sensitive health data more critical than ever.
Experts recommend adopting end-to-end encryption, regular auditing, and Zero Trust architectures to secure environments where multiple service providers handle deeply personal information. Compliance with Canadian privacy and security requirements is not only a legal obligation but also a cornerstone of public trust and resilience in digital services.
The True Cost of a Data Breach
The report underlines that the consequences of a breach go far beyond financial loss. When social and health care systems are compromised, the effects can ripple through communities, undermining trust, jeopardizing safety, and disrupting eligibility for essential benefits. Operational paralysis and organisational strain often follow as resources are redirected from care to crisis management.
Accerta stresses that modernising cybersecurity is now a strategic imperative. A secure-by-design approach is recommended, embedding protection into every layer of people, process, technology, and data. Measures such as encrypting mobile app data, implementing secure APIs for inter-agency collaboration, and mandating security audits for third-party vendors are critical steps. Transparent audit trails across inter-agency exchanges further reduce both technical and ethical risks.
Administrative and physical safeguards are equally important. Robust data-sharing agreements, continuous monitoring, and secure disposal protocols help reinforce accountability and resilience. The Insurance Bureau of Canada (IBC) survey also highlights that many small and medium-sized enterprises underestimate their exposure to cyber threats, even as financial consequences of breaches continue to rise.
Growing Risks from Connected Devices
The rise of connected medical devices, known as the Internet-of-Medical-Things (IoMT), adds another layer of complexity. A global study cited in the report analyzed over 2.25 million IoMT devices and 647,000 operational technology devices across 351 hospitals, revealing that 89% of organizations had devices with known vulnerabilities. Furthermore, 94% of enterprises discover endpoints they didn’t even know existed, with some environments having as many as one in five unmanaged devices.
These findings make it clear: cybersecurity is foundational for Canada’s health care and social services. Protecting sensitive data is a shared responsibility that requires collaboration, vigilance, and innovation.
Public Sector Adoption of AI: Slow and Risky
The report also raises concerns about AI adoption in government offices. Only 22% of Canadian public sector organizations have integrated AI tools, and half of the public servants who use AI rely on publicly available tools. While AI has the potential to enhance efficiency, insufficient training and oversight may introduce additional cybersecurity risks.
The CCN, Accerta, and Darktrace report concludes that protecting sensitive health information cannot be optional. It is a collective responsibility demanding proactive measures, technological innovation, and strict adherence to security protocols. As attacks grow more frequent and sophisticated, the need for action has never been more urgent.
Canada’s health care system is at a crossroads: without comprehensive cybersecurity measures, the consequences extend far beyond data loss—they threaten the very trust and safety of essential public services.