Your CRA Records Are a Ransomware Target. Here's What the Law Says.

There are two threats your accountant worries about and your IT guy doesn't: the Canada Revenue Agency and ransomware. Most small business owners think of those as completely separate problems. They're not. They're on a collision course — and in 2026, Canadian small businesses are being caught in the middle.

Here's the problem in plain terms: Canadian law requires you to keep six years of business records. Ransomware attacks can destroy every one of those records in the time it takes you to pour a coffee. And when the CRA comes asking — because audits don't stop for cyberattacks — the consequences of not having those records fall entirely on you, not on the criminals who stole them.

What the CRA Actually Requires

Under the Income Tax Act and the Canada Revenue Agency's Information Circular IC78-10R5, every Canadian business must retain books and records for a minimum of six years from the end of the last tax year to which they relate. That's not a suggestion — it's a legal obligation with teeth.

Six years is not a short window. For a business operating since 2020, that means your 2020 tax records still need to be accessible today. If you suffer a ransomware attack and lose those records, the obligation to produce them doesn't go away. You still owe the CRA what you owe the CRA — you just no longer have the records to prove your deductions, your expenses, or your reported income.

What Ransomware Actually Does to Business Records

Ransomware is software designed to encrypt every file it can find on a network. It doesn't discriminate. QuickBooks files, PDF invoices, Excel sheets, Outlook archives, scanned receipts — if it's a file, the ransomware encrypts it. In a small business with a single server or a few networked computers, that encryption process typically takes under four minutes from first file touched to full network lockdown, according to research by Splunk in 2023.

Once encrypted, those files are mathematically unreadable. They look like random noise. The only way to get them back is either to pay the ransom (which doesn't guarantee recovery — and which funds the next attack), or to restore from a backup. If you don't have a clean, tested, off-network backup, those files are gone.

What Happens After the Attack

Let's say the attack happens on a Tuesday morning. Your accounting files, going back six years, are gone. Here's what unfolds:

1. Immediate business disruption. You can't invoice. You can't pay suppliers. You can't access your own financial history. If you're in a project-heavy business — construction, trades, consulting — you can't prove what's been billed, what's been paid, or what's outstanding.
2. Insurance claim complexity. Your cyber insurance (if you have it) will want forensic documentation of what happened and what was lost. Without records of what existed before the attack, that process becomes difficult and disputed.
3. CRA liability risk. If the CRA selects your business for an audit — and small businesses are audited at a meaningful rate — you are now unable to produce the records required by law. The CRA's position, under subsection 152(7) of the Income Tax Act, is that when a taxpayer cannot substantiate their reported income and expenses, the burden of proof shifts to the taxpayer. Deductions you can't prove may be disallowed. Income that can't be reconciled may be reassessed upward.
4. PIPEDA notification obligation. If any of those records contained personal information about clients, employees, or suppliers — and they almost certainly did — you now have a breach notification obligation under Canada's federal privacy law. More on that in the PIPEDA article.

Why Small Canadian Businesses Are the Target

A question worth asking: why would ransomware criminals care about a five-person electrical contractor in Burnaby or an eight-person property management company in Calgary?

The answer is simple: volume, ease, and payment rate.

Large corporations have security operations centres, dedicated IT staff, and incident response retainers. They're difficult and expensive to attack. Small businesses — which represent 97.9% of all Canadian employer businesses — typically have no dedicated IT staff, outdated security, unpatched systems, and the kind of business-critical data that makes a ransom payment feel like the only option.

Modern ransomware is not deployed by individual hackers typing in a basement. It's deployed by organized criminal enterprises running Ransomware-as-a-Service (RaaS) platforms. These platforms are subscription businesses. Affiliates pay a fee, get access to the ransomware toolkit, and keep 70–80% of any ransom collected. The ransomware operators take the rest. It's a franchise model — for extortion.

In this model, attacking 100 small businesses at $15,000 each is more profitable and far lower risk than attacking one large corporation at $500,000. Canada ranked second globally for ransomware victims in 2025, according to the Canadian Centre for Cyber Security's National Cyber Threat Assessment.

What an Actual Defence Looks Like

The good news is that the defence isn't complicated. It just requires doing it correctly — which most small businesses haven't.

The core of records protection is the 3-2-1 backup rule: three copies of your data, on two different types of media, with one copy stored off-site (or in the cloud, air-gapped from your main network). For a small Canadian business, this means:

• Daily automated cloud backup to a system that your workstations cannot directly write to (so ransomware can't encrypt the backup)
• A second local backup, kept on a device that is not persistently connected to your network
• Regular tested restores — not just backups, but actual practice of recovering files — at least quarterly

Beyond backups, the second most effective defence against ransomware is preventing it from getting in. The two most common ransomware entry points in Canadian small businesses are: phishing emails (an employee clicks a link or opens an attachment) and exposed Remote Desktop Protocol (RDP), which is an open door that attackers scan for constantly.

Multi-factor authentication (MFA) on all accounts — especially email and any remote access — eliminates the exposed-credential attack vector entirely. Endpoint Detection and Response (EDR) software, which is different from and more effective than traditional antivirus, can detect and stop ransomware before it finishes encrypting your network.

The CRA Audit Scenario You Need to Think About

Here's a scenario that's playing out in Canada right now. A small trades business suffers a ransomware attack. Their accounting software, their invoice archives, their bank statement PDFs — everything on the server is encrypted. They don't have a tested off-network backup. They restore what they can from their accountant's records, but they're missing two years of supporting documentation.

Eight months later, a CRA audit notice arrives — routine, not related to the attack. The CRA requests records from 2021 to 2026. The business can produce the 2024 and 2025 records (the accountant has copies). But the 2021, 2022, and 2023 supporting documents — receipts, purchase orders, vendor invoices — are gone.

The CRA disallows $47,000 in expenses the business cannot substantiate. The business is reassessed. Interest and penalties apply. The loss from the attack — downtime, ransom, recovery costs — was already painful. Now there's a CRA bill on top of it.

This is not a hypothetical. It's the pattern that emerges when a ransomware attack intersects with the six-year record-keeping obligation. And it's entirely preventable.

The Bottom Line

The Income Tax Act doesn't care about ransomware. The CRA doesn't make exceptions because your records were encrypted by criminals. The obligation to keep six years of business records is yours — not your accountant's, not your bank's, not your IT company's. Yours.

The only way to meet that obligation after a ransomware attack is to have had a proper backup system before it. There is no retroactive fix. There is no recovery if the backup doesn't exist.

This is not a "maybe someday" risk. Canada is the second-most-targeted country in the world for ransomware. Small businesses are the preferred target. And the financial consequences of a successful attack, layered on top of the CRA record-keeping obligation, can be severe enough to end a company that would otherwise survive the attack itself.