After a cyber attack or a ransomware attack, keep the affected computers exactly as they are, leave the ransom unpaid and the attacker unanswered, and make the calls: local police (911 if anyone is in danger), your cyber insurer, and the Canadian Centre for Cyber Security’s online report. Then send the form on our emergency page, and a person takes the technical side from there.
The first hours decide whether anyone can later show how the attacker got in. Wiping a computer, reinstalling it or restoring a backup over it destroys the logs and files that record the way in, and the same door then stays open for the next attempt. The Canadian Centre for Cyber Security’s ransomware playbook lists preserving evidence and documenting each step as part of the response, and it asks organizations to assume the attacker is still on the network once a break-in is known.
Isolating the affected systems from the internet and the office network is the first containment measure in that playbook. Doing it without losing evidence depends on how your office is wired, so a person talks you through it on the callback. Note the time the trouble started and what appeared on the screen; every report that follows asks for those two facts.
The Cyber Centre leaves the decision to pay with each organization and warns that paying gives no assurance of getting the encrypted data or systems back. Its playbook asks victims to contact their local police before they even consider paying, notes that attackers who are paid may still demand more money or copy, leak or sell the data, and points out that paying may be unlawful under laws against terrorism and money laundering.
Leave the attacker’s messages unanswered too. A reply tells them someone is reading and under pressure, and any contact is a decision for you, the police and your insurer to make together. The same playbook recommends a way of communicating that the attacker cannot reach, which matters when the company mailbox may be in their hands.
If anyone is in danger or a crime is in progress, call 911. For the cybercrime itself, call your local police service: the Cyber Centre and the Canadian Anti-Fraud Centre both send victims to local police first, and the Anti-Fraud Centre also takes reports online or through its toll-free line.
Your cyber insurer comes next, through the claims line printed in the policy. Some policies ask for prompt notice and name the response firms they will pay for, so a short call protects the claim. The Canadian Centre for Cyber Security takes reports from businesses and organizations in Canada through its online service, Report a cyber incident.
An attack that touched personal information can add a legal duty to report. Under PIPEDA, a breach of security safeguards goes to the Privacy Commissioner of Canada when it is reasonable to believe it creates a real risk of significant harm to an individual, and the people affected are told as soon as feasible. In Quebec, an enterprise must promptly notify the Commission d’accès à l’information and the people concerned when a confidentiality incident presents a risk of serious injury. Ontario health information custodians notify the Information and Privacy Commissioner in the circumstances PHIPA and its regulation set out.
Whether a duty applies is a decision for you and your lawyer. Our part is the facts each notice needs: what happened, when it was confirmed, and which systems and kinds of information the attacker reached.
When a business sends the emergency form in the middle of an attack, this is the order we work in.
The scope and a fixed price go into a scope letter once the first facts are known, and we tell you before anything in that scope changes.
Leave your name and your number. A person calls you back the same business day, usually within an hour, and takes you through what to leave untouched while the reports get made.