A data breach means that information was accessed, copied or lost by someone who should not have had it. It might be a mailbox emptied by an attacker, a laptop left in a taxi, files taken by ransomware, or a spreadsheet emailed to the wrong person. The causes differ, but good data breach prevention follows the same pattern: make it harder to get in, limit what a single mistake can expose, and notice quickly when something goes wrong.
Why prevention is worth the effort
The financial side is substantial. IBM’s 2025 Cost of a Data Breach Report put the average cost of a breach in Canada at CA$6.98 million, and CA$7.91 million where phishing was the initial cause. Those are averages across many organizations, mostly larger than yours, but they show the pattern: how an attacker gets in affects how expensive it gets.
For a smaller business the bigger risks are downtime, lost client trust, and the cost of notifying people, so prevention is usually far cheaper than recovery.
Where breaches usually start
- Stolen or reused passwords. Attackers log in rather than break in.
- Phishing. A convincing email leads to a fake sign in page or a malicious attachment.
- Unpatched software. Known weaknesses in servers and applications are scanned for constantly.
- Misconfiguration. Open cloud storage, overly broad sharing, forgotten admin accounts.
- Human error. Wrong recipient, lost device, shared password.
- Third parties. A supplier with access suffers its own breach.
The controls that matter most
Strong sign in
Turn on multi-factor authentication for email, remote access, admin accounts and any system holding sensitive data. It blocks the large majority of password based attacks. Add a password manager so people stop reusing passwords.
Email and phishing protection
Filter inbound mail, protect your own domain from spoofing, and make it easy to report suspicious messages. Our email security check shows whether your domain is protected.
Patching and endpoint security
Apply updates quickly, encrypt laptops, and use modern endpoint protection that detects behaviour rather than just known malware. Automated patching removes the “we will get to it” delay.
Least privilege
Give people access to what they need and no more. Review access when roles change and remove it when people leave. Remote administrators should use separate accounts.
Backups
Keep at least one copy that cannot be changed or deleted from your main network. Test restores. This is the heart of ransomware protection, and it keeps a breach from becoming a shutdown.
Security awareness training
Short, regular sessions with realistic examples work better than an annual lecture. Teach people to pause on urgency and to verify requests for money or credentials through another channel.
What to do if you suspect a breach
- Contain itDisconnect affected devices, disable compromised accounts, change passwords
- Call for helpContact your IT provider and, if you have one, your cyber insurer
- Preserve evidenceDo not wipe devices or delete logs before they are reviewed
- Assess the dataWork out what was accessed and whose information is involved
- Notify as requiredUnder PIPEDA, report breaches posing a real risk of significant harm to the Privacy Commissioner and affected individuals
- Learn from itFix the cause and update your plan
Having a written incident response plan before this happens saves hours when they matter. Our guide to calculating the cost of a data breach shows what to count.
Our cybersecurity assessment shows where your biggest exposures are and what to do first.
Explore our cybersecurity servicesFrequently asked questions
What is the single best thing we can do?
Enforce multi-factor authentication everywhere it is available, starting with email and remote access.
Are small businesses really at risk?
Yes. Attackers often target smaller organizations because defences are lighter and they can be attacked at scale.
Do we need to tell clients about a breach?
If personal information is involved and there is a real risk of significant harm, Canadian privacy law expects notification. Get legal advice for your specific situation.
Related service: Cyber Security Assessment
Last updated
