Compromised account, network or system: preserve evidence and report the cyber incident to the right authority
Isolate without destroying evidence, secure access from a clean device and use the official questionnaire to route the report.
Do not use a possibly compromised device or network to change critical access or file the report. For a threat to life or a crime in progress, contact police.
Contain carefully
Disconnect affected systems under the response plan without resetting them or deleting logs. Prioritize essential services and physical safety.
Secure access
From a clean device, change compromised credentials, protect email and administrator accounts, revoke sessions and enable multi-factor authentication.
Preserve evidence
Keep dates, alerts, logs, addresses, files, ransom demand, affected accounts, actions and impact. Do not unnecessarily open suspicious files.
Report and coordinate
The Centre’s questionnaire routes individuals and organizations. Also coordinate police, insurer, clients and privacy notices when their tests are met.
Report a cyber incident — Canadian Centre for Cyber Security