What to do · 21
What to do
Something just happened? Plain-language first steps for the incidents we get called about most, from a hacked mailbox to a ransom note.
- What to doCyber ForensicsWhat to do if a former employee still has accessYou've found that someone who left can still sign in somewhere: email, a SaaS app, the VPN, a shared password. Cut the access, then find out whether it was used.
- What to doCyber ForensicsWhat to do if a Microsoft 365 account is hackedAn admin's step-by-step for a compromised Microsoft 365 mailbox. The order matters: lock the attacker out first, record what they did, and only then clean up.
- What to doCyber ForensicsWhat to do if a work laptop is lost or stolenWhether a missing laptop is an inconvenience or a reportable privacy breach usually comes down to one question: was the drive encrypted, and can you prove it?
- What to doCyber ForensicsWhat to do if a work or personal phone with company data is lostA missing phone exposes email, files and often the MFA codes that protect everything else. The steps differ depending on whether the company owns the phone.
- What to doCyber ForensicsWhat to do if clients receive fake invoices that look like they're from youWhen clients forward you an invoice you never sent, the first question is whether someone is spoofing your domain from outside or sending from inside your real mailbox.
- What to doCyber ForensicsWhat to do if personal information was emailed to the wrong personMisdirected email is one of the most common ways personal information ends up where it shouldn't.
- What to doCyber ForensicsWhat to do if someone gave remote access to a 'tech support' scammerA caller or pop-up claiming to be Microsoft, the bank or your IT provider talked someone into installing a remote-access tool.
- What to doCyber ForensicsWhat to do if you clicked a phishing linkClicking a link is not always a disaster. What happens next depends on whether you typed anything, downloaded anything, or allowed anything.
- What to doCyber ForensicsWhat to do if you entered your password on a fake login pageModern phishing kits steal your password, your MFA code and your signed-in session all at once. Resetting the password is necessary but not enough on its own.
- What to doPrivacy & AIWhat to do if you receive a privacy complaint or a letter from a privacy commissionerA letter from the Office of the Privacy Commissioner of Canada, Ontario's IPC or BC's OIPC is serious but manageable.
- What to doCyber ForensicsWhat to do if you receive an extortion emailMost extortion emails are bluffs sent to thousands of people. Some are not. Here is how to tell the difference without engaging the sender, and what to do in each case.
- What to doCyber ForensicsWhat to do if you see a ransom note on a screenFor whoever sees it first. Print this page and post it near your reception desk and server room: the first 15 minutes after a ransom note appears shape everything that…
- What to doCyber ForensicsWhat to do if you sent a payment to a fraudsterIf a wire, EFT or cheque went to an account controlled by a fraudster, the first hour matters most. Call your bank before you do anything else.
- What to doCyber ForensicsWhat to do if you suspect an employee took company dataWhen you suspect someone is leaving with client lists, files or source code, the order of your next steps decides whether you end up with evidence or with a wiped laptop…
- What to doCyber ForensicsWhat to do if your business social media account is hackedA hijacked Facebook page, Instagram account or LinkedIn profile can be used to scam your customers and run ads on your card.
- What to doCyber ForensicsWhat to do if your company's data appears on a leak site or the dark webAn alert, a journalist or a client says your data is on a leak site.
- What to doCyber ForensicsWhat to do if your domain or DNS is hijackedWhoever controls your domain controls where your website and email go.
- What to doCyber ForensicsWhat to do if your website is hacked or defacedDefaced pages are obvious. Hidden spam links, redirects that only fire for search visitors, and skimming code on checkout pages are not.
- What to doCyber ForensicsWhat to do when a vendor asks to change their bank detailsA request to update a supplier's banking information is the single most common set-up for payment fraud. Verify it before any money moves.
- What to doCyber ForensicsWhat to do when a vendor tells you they were breachedA breach notice from a supplier, software provider or service firm can land your organization with its own obligations. Here is how to work out what it means for you.
- What to doCyber ForensicsWhat to do when antivirus or EDR raises an alertA practical triage guide for small IT teams and managed IT staff: how to read the alert, when to isolate, how to tell a false positive from the start of an incident, and…
Incident line · 24 hours, 7 days
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.