Your files are encrypted and a ransom note appears? The first hours decide what happens next. Isolate affected devices, destroy no evidence, call your insurer and the police, then restore only from clean backups. Here is what to do, hour by hour, based on official Canadian guidance.
Under attack right now? Call UpSystems at (438) 888-5941 and choose the Emergency option. Emergency response is a paid service, available even if you are not a client.
Hour 0 to 1: contain
- Isolate. Disconnect affected devices from the network and the Internet: network cable, Wi-Fi, remote access and VPN. The Canadian Centre for Cyber Security recommends isolating all systems and devices.
- Do not touch “patient zero”. The Sûreté du Québec recommends preserving the first infected device without changing it, and unplugging it rather than shutting it down through Windows. If an expert is on the way, leave that decision to them.
- Delete nothing. Keep the ransom note, the encrypted files and suspicious emails. They are evidence, and a decryption tool may exist one day.
- Switch channels. Attackers may be reading your email. Communicate by phone or another channel.
Hour 1 to 4: call the right people
- Your cyber insurer, first. Insurers often ask to be called before anything else and provide a specialized lawyer and a response team.
- Your IT team or provider, for analysis and recovery.
- The police. In Québec, the Sûreté du Québec at 310-4141; elsewhere, your local police. Also report the incident to the national RCMP and Canadian Anti-Fraud Centre system, online since November 2025.
- The Canadian Centre for Cyber Security, through its reporting portal.
Hour 4 to 24: understand and recover
- Assess the scope. Which devices, which accounts, which data? Was information stolen, not just encrypted?
- Check your backups. Only offline backups, or backups separated from the network, are reliable. Scan them on a clean system before restoring.
- Change passwords for admin and user accounts, creating temporary accounts for recovery.
- Document everything: times, actions, people contacted. Your legal obligations and your claim depend on it.
Should you pay the ransom?
The Canadian Centre for Cyber Security leaves the decision to the business, but notes that paying does not guarantee your data back and that attackers may still sell or publish your data. The Sûreté du Québec is more direct: pay no ransom. Paying is not illegal in Canada in itself, but a payment to a sanctioned group can be. Never pay without your insurer and a lawyer.
More and more businesses refuse to pay. At insurer Coalition, 86% of client victims did not pay in 2025.
Your reporting obligations
| Where | What | When |
|---|---|---|
| Québec (Law 25) | Notify the Commission d’accès à l’information and affected people if there is a risk of serious injury; record every incident in the register, kept 5 years | Promptly |
| Ontario and elsewhere in Canada (PIPEDA) | Report to the Privacy Commissioner and notify affected people if there is a real risk of significant harm; keep a record for 24 months | As soon as feasible |
Why the risk is growing
According to the Canadian Centre for Cyber Security, ransomware incidents in Canada have grown about 26% a year since 2021, and the average ransom paid in the country reached $1.13 million in 2023. For an SMB, an attack can decide whether it survives.
What makes the 24 hours easier
- Offline backups, tested every month.
- Multi-factor authentication on every account.
- A written incident response plan, with a contact list: insurer, police, lawyer, IT provider.
- Your insurer’s number, printed, not just in an email.
How UpSystems helps
- Emergency line. (438) 888-5941, Emergency option. Paid service, even for non-clients.
- Before an attack. Our managed services include updates and monitoring, with advanced endpoint protection, 24/7 monitoring and anti-phishing training as options.
- Check that you are ready. A security audit ($300 to $2,500) checks your backups, access and plan. A penetration test (from $4,000) shows where an attacker would get in.
Not in a crisis, but worried? Book a 30-minute call to review your situation. See our security audit.
Frequently asked questions
What should you do first after a ransomware attack?
Isolate affected devices from the network, delete nothing, then call your insurer, your IT provider and the police.
Should you turn off the infected computer?
Disconnect it from the network first. The Sûreté du Québec recommends unplugging the first infected device rather than shutting it down through Windows; ideally, leave the decision to an expert, because shutting down can erase evidence in memory.
Is paying a ransom illegal in Canada?
Not in itself, but paying a sanctioned group can be. Never pay without your insurer and a lawyer.
Does insurance cover the ransom?
It depends on your policy. Call your insurer before any decision: it may require its prior approval.