Incident response FAQ

The time you noticed the problem, who noticed it, what they saw (photograph the screen with a phone), which devices and accounts appear affected, and anything anyone has already changed. A short, honest timeline started in the first hour is one of the most useful things an investigator, insurer or lawyer receives later.

Not if there is any chance email or Microsoft 365 is compromised. Attackers who control a mailbox often read the response messages. Move coordination to phone calls or a separate messaging channel until you know the environment is clean. Our guide to out-of-band communications explains how to set this up in advance.

Resetting the password for an account you know is compromised is reasonable, but a mass reset before you understand how the attacker got in can tip them off and push them to a back door you have not found yet. Attackers in Microsoft 365 often add forwarding rules, app consents or extra sign-in methods that survive a password change. Containment works best as a planned sequence, not a reflex.

Restoring before you know how the attacker got in risks restoring the same weakness, or restoring systems the attacker can still reach. The Cyber Centre's ransomware playbook stresses offline backups, and it also lists investigation and patching before restoration. Confirm the backups are clean and the entry point is closed first.

Rebuilding is often the right end state, but wiping a device before it has been imaged destroys the evidence you may need for an insurance claim, a regulator, or a dispute with a vendor. Ask for a forensic image of key systems before anything is reimaged.

Not on your own. Early messages can reveal how much pressure you are under or what you can and cannot restore. If contact becomes necessary, it should be planned with counsel and your insurer.

Some extortion emails are bluffs built from old breach data. Others follow a real, quiet theft. Do not pay or reply. Preserve the message with full headers and have someone check sign-in logs, mailbox rules and recent large data transfers before deciding it is fake.

Counsel can direct the investigation, which in some cases helps protect the analysis and reports under privilege, and counsel decides notification questions. Whether privilege applies depends on the facts and your jurisdiction, so it is a conversation to have with your lawyer, not something a technical firm can promise.

They are essential for restoring service, but investigation is a different job: preserving evidence, analyzing logs and writing findings that hold up with an insurer or regulator. Many organizations use both, with clear lines between who rebuilds and who investigates.

PIPEDA requires notification to individuals as soon as feasible after you determine a breach creates a real risk of significant harm. Reports to the regulator are also expected as soon as feasible. In practice that means you need enough facts to assess risk quickly, which is why early forensic work matters.

Communication timing is a counsel decision. Saying too much too early can be wrong; saying nothing can damage trust and may breach contracts. Prepare a holding statement and check your client contracts for notice clauses.

Fix the specific entry point first, then the controls that would have caught it sooner: multi-factor authentication everywhere, offline backups, logging that is kept long enough to investigate, and a tested incident response plan. NIST SP 800-61 Rev. 3, published in April 2025, frames incident response as part of overall cyber risk management rather than a one-off event, which is a useful way to plan the follow-up work.