Quick answer
If you suspect ransomware: immediately isolate affected devices from the network (unplug the cable or turn off Wi-Fi, don't shut down if you can avoid it), keep evidence, alert your IT/security provider and cyber insurer, protect your backups, and don't contact or pay the attackers before getting expert and legal advice. Then assess whether personal information was exposed, since Canadian breach-reporting rules may apply.
Isolate fast
Disconnecting stops the spread. Powering off can destroy useful evidence.
Call the right people
IT/SOC, insurer, legal counsel and, where relevant, the privacy regulator.
Protect backups
Attackers hunt for backups. Disconnect them before anything else is restored.
Before anything else: stay calm
Ransomware is a business crisis, not just an IT problem. The first hour is about containing the damage, preserving evidence and getting the right people involved. Do not start deleting things or reformatting machines. You may need that evidence for recovery, insurance and any legal obligations.
The 60-minute timeline
Use the interactive timeline below, or follow these steps in order:
- Minutes 0–5, isolate. Disconnect infected machines from the network and Wi-Fi. Disable VPN access if you suspect it was the entry point.
- Minutes 5–15, secure. Disconnect or lock down backups and cloud sync. Reset passwords and disable accounts that may be compromised (from a clean device).
- Minutes 15–30, alert. Call your IT/security provider, your cyber insurer's incident line, and your lawyer. Many insurance policies require early notice and approved responders.
- Minutes 30–60, assess. Take photos of ransom notes, record the time, note affected systems and note what data they hold. Don't try to "clean up".
What not to do
- Don't pay or negotiate before expert advice. Payment doesn't guarantee recovery and may carry legal risk.
- Don't restore over evidence. Rebuild from clean, verified backups only after the intrusion has been contained.
- Don't use compromised email to coordinate. Attackers may be reading it.
- Don't ignore the entry point. If you restore without closing the way in, you'll be hit again.
Who to call in Canada
- Your IT/SOC provider to contain and investigate. QueryTel can help 24/7.
- Your cyber insurer (if you have a policy).
- Local police and the Canadian Anti-Fraud Centre to report the crime.
- Canadian Centre for Cyber Security (cyber.gc.ca) for guidance and incident reporting.
- Privacy regulators. Under PIPEDA, organizations must report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notify affected individuals. Quebec's Law 25 has similar requirements. Get legal advice on your specific obligations.
After the first hour: recovery and prevention
Once contained, recovery follows a safe order: confirm clean backups, rebuild affected systems, rotate every credential, patch the entry point, and monitor closely for re-entry. Then close the gaps: MFA everywhere, tested offline or immutable backups, endpoint detection and 24/7 monitoring. See our 24/7 SOC, cyber backup and backup vs. disaster recovery guides.
Your ransomware first-hour playbook
Minutes 0–5
Isolate
Unplug the network cable or disable Wi-Fi on affected devices. Don't power off if you can avoid it, since memory can hold evidence. Disable remote access if it may be the way in.
Minutes 5–15
Secure
Disconnect backups and cloud sync from the network. From a clean device, reset privileged passwords and disable suspicious accounts.
Minutes 15–30
Alert
Call your IT/SOC provider, cyber insurer and legal counsel. Tell them exactly what you see and when it started.
Minutes 30–60
Assess
Photograph the ransom note, log the time, list affected systems and data types, and decide whether personal information may be involved.
Frequently asked questions
Should I turn off my computer if it has ransomware?⌄
Disconnect it from the network first. Shutting down can erase volatile evidence, so follow your IT or incident-response provider's advice, but never leave it connected to the network.
Should my business pay the ransom?⌄
Seek expert and legal advice before deciding. Paying does not guarantee you will get your data back, may encourage further attacks and can carry legal and sanctions risk.
Do I have to report a ransomware attack in Canada?⌄
You should report the crime to police and the Canadian Anti-Fraud Centre. If personal information was involved and there is a real risk of significant harm, PIPEDA requires reporting to the federal Privacy Commissioner and notifying individuals. Quebec has its own rules.
Can I recover without paying?⌄
Often yes, if you have clean, tested backups that the attackers could not reach. This is why isolated or immutable backups matter.
Want a Canadian expert to check this for you?
QueryTel's NOC & SOC engineers support businesses across Toronto, Mississauga and Canada. Ask for a free review, with no obligation.