The Quebec Access to Information Commission, together with cybersecurity researchers, reported a dramatic rise in data‑breach incidents across the province. Over the past three years, the number of reported breaches has increased by 559 percent, according to the latest figures released on July 2, 2026.
Among the compromised data, medical records have emerged as a particularly valuable commodity on the black market. The same sources indicated that individual health files are being offered for sale at prices ranging from $250 to $1,000 per person. This price range reflects the growing demand for personal health information among cybercriminal networks.
The surge in breaches coincides with the province’s recent rollout of a new digital health records system. Officials have noted that the expanded digital infrastructure provides additional entry points for unauthorized access, prompting heightened scrutiny from privacy advocates and technology experts. The Access to Information Commission highlighted that the increase in reported incidents does not necessarily capture all occurrences, as many breaches remain undisclosed.
Cybersecurity researchers monitoring the situation confirmed that the market for medical data has become more lucrative in recent months. They observed that the pricing of health records aligns with the perceived value of detailed personal information, which can be used for identity theft, fraud, and targeted phishing campaigns.
Provincial authorities have not released specific details about the types of organizations affected, but the overall trend suggests that both public and private entities handling health information are vulnerable. The Commission reiterated the importance of robust security measures, including encryption, multi‑factor authentication, and regular security audits, to mitigate further exposure.
As the province continues to integrate digital health solutions, the reported 559 percent increase in data‑breach incidents serves as a metric for ongoing risk assessment. Stakeholders are advised to remain vigilant and to adopt recommended cybersecurity practices to protect sensitive personal data.