The numbers come from 446 breaches that were reported to the Office of the Privacy Commissioner of Canada (OPC). Victims of these kinds of data breaches are vulnerable to identity theft, financial crime, even violence in some cases. 

The number of Canadians impacted by a data breach during this time is likely higher, as this estimate does not include how often public bodies lose or mishandle personal data. The new reporting laws that require businesses to report breaches where there could be a real risk of significant harm to the OPC and the people affected came into effect in November 2018. Between then and June 2019, the OPC received 446 breach reports, nearly six times the number of reports received during the same time period under the previous voluntary reporting system.

Of the 446 breaches reported to the OPC, most (59%) were a result of unauthorised access such as a hack or ‘internal bad actor’. Moreover, 22% were from accidental disclosures, such as information being sent to the wrong person or being left behind, 13% of reports were from loss of data, which could be the physical loss of a usb drive or even paper files, and 6% was from physical theft of things like computers, drives or paper files.