Article Summary: If your Canadian business is hit by a cyberattack, the first hour matters. Isolate affected devices rather than powering them off immediately, contact your IT or incident-response provider by phone, preserve evidence, and contact your bank immediately if money has been stolen or transferred. This article explains what to do step by step, including how to report cybercrime in Canada and when a privacy breach may need to be reported.
If a cyberattack hits your business, what you do in the first hour really matters.
It’s also the easiest time to make a costly mistake, like turning off the wrong machine, deleting evidence, or replying from an email account the attacker is already reading.
The steps below tell you what to do, in order, so you’re not guessing in the moment.
The first actions are straightforward enough for a non-technical person to start, but you should involve your IT or incident-response provider as quickly as possible.
Before anything else: don’t make it worse
Before you touch anything, avoid these:
- Don’t immediately turn the affected computer off. Disconnect it from the network first. Once isolated, leaving it powered on can help preserve forensic evidence. However, if malware is actively spreading or continuing to cause damage, powering off the device may be necessary. Contact your IT or incident-response provider as quickly as possible.
- Don’t delete anything. Leave the ransom note, the suspicious email, and any alerts exactly where they are. They’re what your IT team and investigators will need.
- Don’t pay a ransom on the spot.
- Don’t use the hacked email or accounts to talk about the attack. If an attacker is in your inbox, they can read those messages. Switch to phone calls or a different account.
The step by step
Work through these in order, starting the moment you notice something’s wrong.
- Disconnect the affected devices from the network. Unplug the network cable and turn off Wi-Fi on anything that looks affected. The Canadian Centre for Cyber Security recommends isolating infected systems and devices from the Internet and internal networks to reduce the risk of the infection spreading. Once isolated, avoid powering the device off unless malware is still actively spreading or causing damage, or your IT or incident-response provider advises you to do so.
- Call your IT provider straight away, by phone. Don’t email, in case the attacker is watching your inbox. If you have cyber insurance, call them next, because many policies require you to involve their incident team early.
- Leave the evidence alone. Don’t wipe, reinstall, or tidy up the affected machines yet. Screenshots of the ransom note or suspicious emails are useful, but keep the originals too.
- If money was sent, call your bank immediately. Ask them to recall the transfer and freeze it if they can. With wire and bank fraud, acting in the first few hours makes the biggest difference.
- Secure compromised accounts from a clean device. Working with your IT or incident-response provider, reset compromised passwords, revoke active sessions and access tokens, and ensure multi-factor authentication is enabled. Prioritize email and administrator accounts.
- Report the incident. Depending on what happened, this may include your local police service, Canada’s Report Cybercrime and Fraud service, the Canadian Centre for Cyber Security and, where required, the appropriate privacy regulator.
Where to report a cyberattack in Canada
If your business experiences a cyberattack, there may be several organizations you need to contact depending on what happened.
Contact your local police service
If you have been the victim of ransomware, fraud, theft, extortion or another cybercrime, report it to your local police service as soon as possible.
For an active emergency or immediate threat to someone’s safety, call 911.
Report the incident through Canada’s national cybercrime reporting system
Businesses and individuals can report cybercrime and fraud through the Government of Canada’s Report Cybercrime and Fraud service.
This national system is operated by the RCMP’s National Cybercrime Coordination Centre and the Canadian Anti-Fraud Centre. Reporting helps law enforcement identify related attacks, investigate criminal activity and understand cybercrime trends across Canada.
You should report the incident even if you have already contacted your local police service.
Report the incident to the Canadian Centre for Cyber Security
Organizations can also report cyber security incidents to the Canadian Centre for Cyber Security.
The Cyber Centre is Canada’s national technical authority on cyber security. Sharing information about an attack can help the Cyber Centre identify threats affecting other Canadian organizations and provide advice on containment and recovery.
For ransomware incidents, the Cyber Centre recommends reporting the attack to:
- Your local police service
- The Canadian Anti-Fraud Centre
- The Canadian Centre for Cyber Security
If money was sent to a scammer
Contact your bank or financial institution immediately.
Ask whether the transaction can be stopped, frozen or recalled. With business email compromise, invoice fraud and fraudulent wire transfers, acting quickly can make a significant difference.
Then:
- Contact your local police service.
- Report the incident through Canada’s Report Cybercrime and Fraud service.
- Contact your cyber insurance provider, if applicable.
- Preserve emails, transaction records, banking information and other evidence.
Do not communicate with the suspected attacker from an email account that may have been compromised.
If personal information was exposed
A cyberattack can also become a privacy breach.
Canadian businesses need to determine whether personal information belonging to customers, employees or other individuals was accessed, stolen, altered or disclosed.
Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), organizations subject to the Act must report a breach to the Office of the Privacy Commissioner of Canada when it is reasonable to believe that the breach creates a real risk of significant harm to an individual.
Significant harm can include identity theft, financial loss, damage to reputation, humiliation, loss of employment or other serious consequences.
If that threshold is met, affected individuals must also be notified.
Unlike some jurisdictions, PIPEDA does not impose a general 72-hour reporting deadline. The breach must instead be reported and affected individuals notified as soon as feasible after the organization determines that the breach occurred.
Organizations subject to PIPEDA must also keep a record of every breach of security safeguards involving personal information for at least 24 months, including breaches that do not meet the threshold for mandatory reporting.
Privacy requirements can differ depending on your province, industry and the type of information involved. Alberta, British Columbia and Quebec have provincial private-sector privacy legislation, and industries such as healthcare may have additional requirements.
If personal information may have been compromised, involve your privacy officer, legal counsel, cyber insurer and incident-response team early.
Should you pay the ransom?
The Canadian Centre for Cyber Security warns that paying a ransom does not guarantee that your data or systems will be recovered. Attackers may still demand more money, retain or publish stolen data, or target your organization again. There may also be legal implications associated with a payment. Before considering a ransom payment, contact law enforcement and involve your incident-response team, cyber insurer and legal counsel.
The best time to prepare is before it happens
All of this is far easier if you’ve decided some of it in advance. You don’t need a thick binder, just a simple plan that covers:
- Who to call first (your IT provider, your insurer) and their numbers, kept somewhere you can reach without your main systems.
- Where your backups are, and proof they’ve been tested by restoring from them.
- Which accounts and devices matter most, so you know what to protect first.
A single page covering those is enough for most small businesses, and it’ll save you a lot of scrambling if the day ever comes.
Frequently Asked Questions
What’s the first thing to do in a cyberattack?
Disconnect the affected devices from the network, by unplugging the network cable and turning off Wi-Fi, then call your IT provider by phone. Getting the device off the network stops the problem spreading while you get help.
Should I turn off the computer if I get ransomware?
If possible, disconnect the device from the network first by unplugging the network cable and turning off Wi-Fi. Once isolated, the Canadian Centre for Cyber Security recommends leaving a ransomware-infected device powered on to help preserve forensic evidence. However, if malware is still actively spreading or causing damage, powering off the device may be necessary. Contact your IT or incident-response provider immediately.
Should I pay the ransom?
The Canadian Centre for Cyber Security warns that paying a ransom does not guarantee that you will regain access to your data or systems, and attackers may still demand more money, leak your data or target you again. Before considering payment, involve law enforcement, your IT or incident-response team, cyber insurer and legal counsel. Your responders or law enforcement can also determine whether a trusted decryption tool may be available.
We wired money to a scammer. What do we do?
Call your bank or financial institution immediately and ask whether the payment can be stopped, frozen or recalled. Then contact your local police service and report the incident through Canada’s Report Cybercrime and Fraud service. Preserve the emails, payment instructions and transaction records for investigators.
Who do I report a cyberattack to in Canada?
If your business has been the victim of cybercrime, contact your local police service and report the incident through Canada’s Report Cybercrime and Fraud service. Organizations should also consider reporting significant cyber incidents to the Canadian Centre for Cyber Security.
If personal information was compromised, determine whether you also have an obligation to report the breach to the appropriate privacy regulator and notify affected individuals. Under PIPEDA, this is required when the breach creates a real risk of significant harm.
—
