Under attack? Start here

Our incident line is answered 24/7: (289) 582-9930. If you can't safely use your normal phone or email (for example, you think your mailbox is being read), call from a mobile phone that isn't connected to the affected network.

If you have a cyber insurance policy, the policy usually names a claims or breach hotline. Call it too, early. Many policies expect prompt notice and some want you to use approved vendors, so check before you sign anything with anyone, including us.

If there is a threat to someone's safety, or money has just left your account, call your local police and your bank first.

• Write down the time you noticed the problem and who noticed it.
• Photograph anything on screen (ransom notes, alerts, odd messages) with a phone.
• Unplug affected computers from the network (cable out, Wi-Fi off). Leave them powered on unless a responder tells you otherwise.
• If money is involved, call your bank's fraud line immediately and ask about recalling the payment.
• Keep a simple running log: what you saw, what you did, when, and who you told.
• Move incident conversations to phone or a separate account if you think email is compromised.

• Don't wipe, reimage or 'clean up' machines before evidence is captured.
• Don't delete suspicious emails, inbox rules or user accounts. Disable or block instead; deletion destroys the trail.
• Don't contact the attacker, reply to extortion messages or pay anything before talking to your responder, insurer and lawyer.
• Don't announce the incident by email company-wide if email may be compromised.
• Don't let well-meaning staff or relatives 'have a look' at a laptop that may be evidence.

Each guide below is a short, ordered checklist for one specific problem. Tap the one that matches what you are seeing.

For the full engagement, from containment to the written report, see cyber incident response services.

• A ransom note or encrypted files: Ransom note on screen
• We paid an invoice or wire to the wrong account: Sent money to a fraudster
• A vendor emailed new banking details: Vendor asks to change bank details
• Clients got invoices that look like they came from us: Clients getting fake invoices from you
• Someone clicked a link or typed a password into a fake page: Clicked a phishing link / Entered a password on a fake login page
• A Microsoft 365 mailbox is sending spam or has odd rules: Microsoft 365 account hacked
• An antivirus or EDR alert: Antivirus or EDR alert
• A laptop or phone is lost or stolen: Lost or stolen laptop / Lost or stolen phone
• An extortion email, or our data on a leak site: Received an extortion email / Company data posted online
• Someone gave a 'tech support' caller remote access: Gave remote access to a scammer
• Website defaced, or domain/DNS changed: Website hacked or defaced / Domain or DNS hijacked
• An employee may have taken data, or an ex-employee still has access: Employee took company data / Former employee still has access
• Personal information emailed to the wrong person: Email sent to the wrong person
• Social media account taken over: Social media account hacked

Bring in legal counsel early. Communications with your lawyer about the incident may be protected by privilege, and counsel can decide whether a privacy breach must be reported to the Office of the Privacy Commissioner of Canada (OPC) or a provincial commissioner, and whether affected people must be notified.

Notify your insurer according to your policy. Keep copies of every notice you send.

You can also report cyber incidents to the Canadian Centre for Cyber Security (cyber.gc.ca/en/incident-management, or 1-833-CYBER-88) and fraud or cybercrime to police and the Canadian Anti-Fraud Centre through reportcyberandfraud.canada.ca. Reporting does not replace calling your bank, insurer or lawyer.

• Your name, role and a phone number that isn't on the affected system.
• What you saw, when, and on which devices or accounts.
• Whether money moved, and the bank and amount if so.
• Your email platform (Microsoft 365, Google Workspace, other) and who holds admin access.
• Who manages your IT today, and how to reach them.
• Whether you have cyber insurance, and the policy or claim number if you have one.
• What has already been done (passwords reset, machines shut down, backups restored).

If a supplier, software vendor or service provider has told you they were breached, your own systems may be fine but your data, logins or integrations may not be. Start with what to do when a vendor says they were breached.

If you've received a complaint or a letter from a privacy commissioner, read what to do about a privacy complaint or regulator letter. For a timeline of the whole response, see the first 72 hours of a cyber incident.