I've Been Hacked — Start Here
Stay calm. Select your scenario below and follow the steps in order. Call the Canadian Anti-Fraud Centre first if it involves fraud or money movement.
Files encrypted, ransom note displayed. Do NOT shut down — isolate instead.
Immediate (First 30 min)
- Isolate affected systems from the network (do NOT shut down)
- Photograph/screenshot the ransom note and any encrypted file extensions
- Call your cyber insurance carrier's 24/7 breach hotline
- Do NOT pay the ransom without expert guidance
Short-Term (24–72 hours)
- Engage a Canadian IR firm or your carrier's panel counsel
- Report to the Canadian Centre for Cyber Security (cyber.gc.ca) and RCMP
- Begin legal hold — preserve all logs and system memory
- Assess backup integrity before any restore attempt
Recovery Phase (Week 1–2)
- Containment and evidence preservation
- Establish clean out-of-band communication channel
- Eradication: rebuild from clean, verified backups
- Full credential reset across all systems and accounts
Post-Recovery (Month 1–6)
- Breach notification — PIPEDA (real risk of significant harm) and provincial laws (e.g. Law 25 in Quebec)
- Office of the Privacy Commissioner of Canada if PIPEDA threshold met
- Full security reassessment with your MSP
- Insurance renewal with documented improved posture
Scenario-Specific Emergency Contacts
- Canadian Centre for Cyber Security: cyber.gc.ca/en/incident-management
- Canadian Anti-Fraud Centre: 1-888-495-8501
- RCMP — Canadian Cybercrime: rcmp-grc.gc.ca
- Office of the Privacy Commissioner of Canada: priv.gc.ca — breach reporting
All Canadian Reporting Contacts
Bookmark these. The right contact depends on what happened and where your business is located.
Canadian Centre for Cyber Security (Cyber Centre)
https://www.cyber.gc.ca/en/incident-management
Canadian Anti-Fraud Centre (CAFC)
https://www.antifraudcentre-centreantifraude.ca
Get Cyber Safe (Public Safety Canada)
https://www.getcybersafe.ca
Office of the Privacy Commissioner of Canada (OPC)
https://www.priv.gc.ca/en/privacy-topics/business-privacy/breaches-and-safeguards/privacy-breaches-at-your-business/
CyberSecure Canada Certification (Standards Council of Canada)
https://scc-ccn.ca/accreditation/accreditation-programs/management-systems/cybersecure-canada
Canadian Cyber Threat Exchange (CCTX)
https://cctx.ca
RCMP — Cybercrime
https://www.rcmp-grc.gc.ca/en/crime-prevention/cyber-crime
Innovation, Science and Economic Development Canada (ISED)
https://www.ic.gc.ca/eic/site/icgc.nsf/eng/home
Commission d'accès à l'information du Québec (CAI)
https://www.cai.gouv.qc.ca
Office of the Information and Privacy Commissioner of Alberta (OIPC AB)
https://www.oipc.ab.ca
Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)
https://www.oipc.bc.ca
Information and Privacy Commissioner of Ontario (IPC)
https://www.ipc.on.ca