Screens locked, files renamed, a ransom note on the desktop. The decisions you make in the next hour decide whether this is a bad week or a business-ending event. Here's what to do, in order.
1. Disconnect, don't switch off
Unplug network cables and turn off Wi-Fi on affected computers, and disconnect the office from the internet if you can. Leave the machines powered on. Shutting them down can destroy evidence that helps investigators work out how the attackers got in and what they took.
2. Call for help before you do anything else
Phone your IT provider and your cyber insurer. Many insurance policies require you to use their approved response team, and calling them first protects your coverage. Don't run cleanup tools or restore from backup yet; you could wipe the trail or restore straight into an infected network.
3. Don't pay, and don't negotiate on your own
Paying doesn't guarantee your files come back or that stolen data gets deleted. If payment is ever considered, it should only happen with your insurer, lawyer and response team involved.
4. Switch to phones and paper
Assume email may be compromised. Use phone calls to coordinate, and keep a written log of what happened and when. You'll need it for your insurer, and possibly for regulators.
5. Think about who you must tell
If personal information may have been accessed, Canadian privacy law (PIPEDA, and PHIPA for health information in Ontario) can require you to notify the regulator and the people affected. You can also report the attack to the Canadian Centre for Cyber Security and the Canadian Anti-Fraud Centre. Get advice before sending any notices.
Prepare now, not during
A one-page incident plan, tested offline backups and endpoint protection that isolates infected devices automatically will make that first hour far less frightening. See how we help, or book a call to put a plan in place.