You came in Monday morning and the ransom note was on every screen. Or a staff member called to say they can't log in to anything. Or your accountant noticed that three months of financial records are suddenly inaccessible — and what's accessible is garbage, files that won't open.
Whatever the trigger, here's what most business owners want to do: remove the problem and get back to work as fast as possible. Wipe the computers. Reinstall. Keep it quiet. Move on.
Here's what actually needs to happen: the response to a cyberattack is a deliberate, sequential process. Shortcuts create more problems. Mistakes made in the first hours can compromise your insurance claim, violate your legal obligations, and make it impossible to understand what was actually taken. The incident is not over when the ransomware is removed. In many cases, it's just beginning.
The First Hour: Contain, Don't Cure
Your instinct will be to fix it. Resist. The first priority is containment — stopping the spread — not recovery.
Isolate affected systems. Disconnect affected computers from the network — unplug ethernet cables, disable WiFi. But do not turn them off. Powered-on systems preserve volatile memory (RAM) that forensics can use to understand how the attack worked and potentially recover encryption keys. Turning systems off destroys that evidence.
Do not wipe anything yet. Before anything is wiped, formatted, or "fixed," forensics needs to examine it. You will almost certainly need a forensic firm. Most cyber insurance policies require a forensic investigation before they'll pay anything. Wiping systems before forensics is complete can void your claim.
Document what you see. Take photos with your phone. Photograph ransom notes. Note which systems are affected, what error messages appear, what times the first issues were noticed. This documentation will matter for your insurance claim and potentially for law enforcement.
Change credentials from an unaffected device. Change passwords for email accounts, banking, and any other critical systems — from a device that wasn't on the compromised network (use your personal phone if necessary). If the attacker still has credentials, they can cause more damage while you're trying to respond.
The First Four Hours: Notify the Right People
Call your cyber insurer. Your policy almost certainly has a breach hotline. Call it. The insurer will typically dispatch an incident response firm from their approved vendor list, which is important for two reasons: (1) it's the fastest way to get qualified forensic help, and (2) using your insurer's approved vendor ensures the costs are covered under the policy without a dispute about whether the vendor was authorized.
Don't try to find and hire a forensics firm yourself before calling your insurer — that engagement may not be covered if it's not through the insurer's approved list.
Brief a lawyer. A privacy lawyer, specifically one experienced in data breach response. Not to do anything yet — just to have them on standby. If personal information was exposed, you have notification obligations under PIPEDA, and the clock on "as soon as feasible" has started. Legal counsel will help you assess the obligation and draft the notification, and their involvement protects privilege over your internal communications about the incident.
Brief your key staff. Your employees need to know what happened and what not to do — specifically, not to talk to clients about the incident until communications have been coordinated, not to use company systems until cleared, and not to speculate on social media. A poorly handled staff communication creates reputational problems you don't need while you're managing the technical incident.
Don't make the ransom decision immediately. The ransom amount is almost always negotiable — ransomware groups expect negotiation, and documented outcomes show 20–60% reductions from the initial demand are common. Your insurer's incident response team and legal counsel should be involved before any ransom payment. Additionally, ransom payments must be sanctions-screened — paying a sanctioned entity is a federal offence in Canada regardless of the circumstances.
The First 72 Hours: Legal Obligations
Within 72 hours of determining that a breach has occurred that poses a real risk of significant harm to individuals, PIPEDA requires you to report to the Office of the Privacy Commissioner of Canada. If the forensics are still ongoing, you can report with the information available and update later.
The OPC breach report requires: what happened, when it happened, what personal information was involved, how many individuals were affected, and what you're doing about it. It does not require a complete forensic report at the time of filing — the "as soon as feasible" standard recognizes that you may not have full information immediately.
Simultaneously, begin preparing individual notifications. Affected clients and employees need to be notified directly, in plain language, about what happened and what data of theirs was involved. Your lawyer will draft these. Do not send them without legal review — a poorly worded notification letter can create additional liability.
The First Week: Forensics and Decision-Making
While forensics is underway, the key questions you need answered before making recovery decisions are:
- How did the attacker get in? Until you know the entry point, you can't close it. Restoring systems without closing the entry point means you'll be attacked again.
- When did the attacker first gain access? Attackers often dwell inside networks for weeks before triggering ransomware. Your backup may be compromised if the attacker was present before your most recent backup. You may need to restore from a backup that predates the initial compromise — which could mean losing weeks of data.
- What did they access or exfiltrate? Double extortion — where attackers threaten to publish stolen data if the ransom isn't paid — requires knowing what data they have. Forensics can often determine this from network logs and system artifacts.
- Are clean backups available? What date they're from, whether they're intact, and whether they can actually be restored. If clean backups exist and predate the initial compromise, recovery without paying ransom is feasible.
Reporting to Law Enforcement
You should report to law enforcement. In Canada, cybercrime is reported to:
- Local RCMP or municipal police — for the initial police report, which you'll need for your insurance claim
- Canadian Centre for Cyber Security (CCCS) — at cyber.gc.ca, which tracks ransomware incidents and provides technical advice
- Canadian Anti-Fraud Centre (CAFC) — at antifraudcentre.ca, particularly relevant if there were wire fraud components
Law enforcement will rarely recover your money or catch the attackers — that's the honest reality for most small business incidents. The value of reporting is for your insurance claim (insurers want a police report), to contribute to national intelligence on active threats, and in the rare case that the investigation is part of a larger takedown effort, your report may contribute to that.
Businesses that suffer ransomware attacks are at elevated risk of a second attack within 12 months. Attackers know you've demonstrated a willingness to pay, and your name may be sold to other groups. Additionally, if the initial entry point wasn't properly closed — or if the attacker left a backdoor — recovery doesn't end the exposure. Before declaring the incident resolved, have your forensics team confirm that all persistence mechanisms (backdoors, additional accounts created by the attacker) have been identified and removed.
After Recovery: What Changes
The incident is an opportunity — a painful, expensive one — to implement the controls that would have prevented it. Organizations that don't change their security posture after an incident are frequently hit again. The controls that matter most post-incident:
- MFA on all accounts — email, remote access, administrative systems
- Endpoint Detection and Response (EDR) replacing or supplementing legacy antivirus
- Off-network backups, tested regularly
- Closing the specific entry point that was exploited — whether that's unpatched software, exposed RDP, or a phishing-susceptible email environment
- Documented incident response plan — so the next incident (hopefully never) doesn't start from zero
A cyberattack is not the end. 40% of small businesses that experience one do recover and continue operating. The ones that recover are the ones that followed the right process — contained quickly, involved the right expertise, met their legal obligations, and used the incident to improve their posture.
The ones that don't recover are often the ones that wiped everything immediately, handled it informally, didn't notify anyone, and discovered six months later that the attacker was still in the network.