InfoSecHub

// incident help

What to do after a cyber incident

Start with the first steps, then work out who needs to hear about it. In an emergency or a crime in progress, call your local police.

// first steps

The first hour

  1. Contain itDisconnect affected devices from the network and from Wi-Fi. Do not power them off or wipe them if you can avoid it, because that destroys evidence.
  2. Preserve evidenceKeep logs, suspicious emails, ransom notes, and screenshots. Write down the times and what you saw.
  3. Secure accountsChange passwords and revoke sessions for affected accounts from a clean device. Turn on multi-factor authentication.
  4. Call for helpReach your incident response provider, your cyber insurer if you have one, and legal counsel. Insurers often require early notice.
  5. Decide who to tellUse the list on this page. If personal information is involved, privacy law may require notice to a regulator and to the people affected.

// who to contact

Where to report

Canadian Centre for Cyber Security

Cyber incidents affecting an organization or an individual

Use the online form, which asks whether the incident affects an individual or an organization and then points you to the right place to report.

Canadian Anti-Fraud Centre

Fraud and scams, including phishing and online payment fraud

Report through the Centre’s website, which also tracks fraud trends in Canada.

Office of the Privacy Commissioner of Canada

A privacy breach at a private-sector organization that creates a real risk of significant harm

Follow the breach reporting guidance for businesses.

Commission d’accès à l’information du Québec

A confidentiality incident involving personal information in Quebec that presents a risk of serious injury

Use the Commission’s website for the current reporting process.

Your local police

Emergencies and crimes in progress, and any incident involving threats or extortion

Call your local police. The Cyber Centre form directs emergencies there.

// ransomware

If it is ransomware

The Cyber Centre publishes a prevention guide and a response playbook. Read the playbook before you need it.

Ransomware guide

A note on payment

Whether to contact or pay attackers involves legal, insurance, and sanctions questions. Get advice from counsel and your response provider before any contact with the attacker.

InfoSecHub is not an incident response service and cannot take reports. This page points you to the organizations that can. It is general information, not legal advice.