Ransomware in a Quebec Small Business: Isolate, Report and Recover
Contain the incident without destroying evidence, protect backups and coordinate IT, insurance, police and privacy duties.
Activate the incident plan
Identify affected devices, accounts, sites and services. Suspend compromised access, protect administrator accounts and use an unaffected communication channel. Preserve times, ransom messages, logs, addresses, files and every action taken.
Bring in the responders
Contact the incident-response provider, cyber insurer and privacy or legal adviser when relevant. Report the incident to the Canadian Centre for Cyber Security and contact police when crime or extortion is involved.
Personal information
Quickly assess whether data was viewed, removed or made unavailable. In Quebec, a confidentiality incident must be documented and may require notice to the Commission d’accès à l’information and affected people when it creates a risk of serious injury. Have that assessment validated.
Decide and recover
Payment does not guarantee decryption or deletion and can create additional risks. Obtain specialist advice before any decision. Restore only from verified backups into a clean environment, rotate credentials and document remediation before reconnecting.
Ransomware playbook — Canadian Centre for Cyber Security · Report a cyber incident