For businesses, right now
If it is happening right now, start here.
Files encrypted. Somebody else reading your email. Money sent to an account that turned out not to be your supplier. A server nobody can log in to. Below is what to do in the next ten minutes, then how to reach us. Read the steps first. They cost nothing, they work whether or not you ever speak to us, and one or two of them stop being possible once somebody has tidied up.
Before you call anybody
The first ten minutes.
In this order. Nobody is in trouble and nobody needs to be technical to do any of it.
Disconnect, but do not switch off
Unplug the network cable, or turn off the Wi-Fi, on anything you think is affected. Leave the machine running. Switching it off throws away evidence held in memory, and in some cases it throws away the only remaining chance of recovering files.
Ring your cyber insurer before anybody else
If you hold a cyber policy, this is the most valuable item on this list. Most policies require you to use their own response firm, and work done by anybody else can be refused. One phone call protects the claim, and it usually brings you a responder at no cost to you.
Stop any payment that is in flight
If this started with an email about changed banking details, telephone your bank and telephone the supplier, on numbers you already had rather than numbers in the email. Same day matters here. Recall is sometimes possible and it gets harder by the hour.
Delete nothing
Not the ransom note, not the odd email, not the sign-in history, not the logs. It all looks like mess and it is all evidence. Somebody is going to need it, whether that is your insurer, your lawyer, or us.
Change passwords from a device you trust
Start with email, then anything that moves money. Use a phone or a laptop that has been nowhere near this. Switch on multi-factor authentication anywhere it is not already on, and sign out every other session while you are there.
Write down what you saw and when
Who noticed, at what time, what was on the screen, what was clicked. Memory gets worse over the next few hours, and this becomes the timeline that everything afterwards is built on.
So you do not waste a phone call
This page is for businesses.
We take incidents at companies, professional practices, clinics, non-profits and registered organisations. We do not take personal accounts, home computers, hacked social media profiles, or cryptocurrency recovery. That is not us being unhelpful. Personal cases need different people, and there are better ones than us for it.
If this is personal rather than business, start with your bank, your local police detachment, and the Canadian Anti-Fraud Centre. They are the right first calls and they cost nothing.
- Yes: companies and partnerships
- Yes: practices, clinics and firms
- Yes: non-profits and societies
- No: personal, home and social accounts
What happens if you call us
Triage first, and no commitment in it.
How to reach us
The telephone, every time.
In business hours, Monday to Friday, 8:30am to 5:00pm Pacific, the average time to reach a technician is 37 seconds. If your business has stopped, do not fill in a form.
Calls are answered by a human, 24/7. Outside business hours that is a Canadian support desk in Ontario, who take the details and pass them on. A technician picks it up the next business morning unless you already hold 24/7 cover with us. We would rather you knew that now than found it out at two in the morning.
After the fire is out
Already had one, and not quite convinced it was handled?
A lot of businesses get through an incident, get told it is dealt with, and never entirely believe it. That is a reasonable feeling and it is usually worth checking. It does not have to be an incident we had anything to do with.
-
Whether the way in is actually closed
Quite often the symptom was fixed and the door was left open. The second attempt usually comes through the first one.
-
Whether anything was left behind
Forwarding rules quietly copying your mail elsewhere, an extra account nobody recognises, a remote access tool that was never uninstalled.
-
Whether your backups would survive a second go
Most ransomware looks for the backups first. Having them is not the same as being able to restore from them, and the difference only shows when you try.
-
Whether you can show what happened
An insurer, a large client or a regulator may ask. Being able to answer calmly, in writing, is worth a great deal more than saying it was sorted out.
Report it
Tell us what is happening.
If your business has stopped, telephone 250-412-3785 instead. This is for when a call is not practical, or for out of hours when you would rather the details were sitting there waiting for us.
- Businesses and organisations only
- No charge and no commitment for the first conversation
- We will say so if your insurer’s firm should take this instead
- Treated as confidential, and not shared with anybody
Active compromise
Protected by reCAPTCHA. Please do not put passwords or account details in this form.
Questions people ask mid-incident
The ones that come up every time.
What counts as an active compromise?
Anything where somebody who should not be in your systems appears to be in them, or has been recently. Files encrypted with a ransom demand. Sign-ins to a mailbox from somewhere nobody has been. An invoice paid to banking details that turned out to be somebody else’s. A rule quietly forwarding your mail out of the business. Machines behaving oddly all at once.
If you are not sure, that is still worth a phone call. Half the calls we take turn out to be something ordinary, and finding that out takes about fifteen minutes.
Do we have to be a client already to call about an incident?
No. The first conversation is free and open to any business, whether we have ever spoken before or not.
What we will not do is pretend the situation is simpler than it is. Coming into an environment somebody else built, mid-incident, is the hardest work in this trade. On that first call we will tell you honestly whether we are the right people for it, and if we are not, we will tell you who is.
Should we pay the ransom?
That is not a decision to take in the first hour, and it is not ours to make for you. It belongs with your insurer, your lawyer and your directors, in that order.
What is worth knowing while you decide: paying does not always produce a working key, it does not undo anything that was copied out of your business beforehand, and it tends to mark you as a business that pays. There are also sanctions rules in Canada that can make certain payments unlawful, which is precisely why the lawyer belongs in the conversation.
Our job at that point is to buy you the time to decide properly, and to find out whether you need to decide at all.
Will you work with our cyber insurer?
Yes, and we would rather you called them before you called us.
Most cyber policies require you to use a response firm from their own panel, and work carried out by anybody else can be refused. That is a real risk to a claim worth far more than our invoice. One phone call to your insurer protects it, and it usually brings you a responder at no cost to you.
If their firm takes the lead, we are happy to work alongside it. Somebody has to know your systems, and that part does not stop being useful.
What does an emergency engagement cost?
It is charged at an emergency rate, with a minimum block of hours, and you get both in writing before anybody touches anything.
The first conversation is free and carries no obligation. If at the end of it the answer is that your insurer’s firm should handle this, or that you can close it out yourselves, we will say so and there is nothing to pay.
Do you help with personal or home accounts?
No. We take incidents at businesses, professional practices, clinics, non-profits and registered organisations only. We do not take personal email accounts, home computers, hacked social media profiles or cryptocurrency recovery.
That is not us being unhelpful. Those cases need different people and different powers. If it is personal, your bank, your local police detachment and the Canadian Anti-Fraud Centre are the right first calls, and none of them charge you.
Do we have to tell anybody that we were breached?
Possibly, and it is worth finding out early rather than late.
Canadian privacy law requires organisations to report a breach of security safeguards to the Privacy Commissioner, and to notify the people affected, where it creates a real risk of significant harm. Your contracts may add obligations of their own, and a regulated profession usually does too.
We are not lawyers and we will not pretend to be. What we can do is help you establish what actually happened and what was reachable, which is the part every one of those decisions depends on.
Not an emergency, but it worries you?
Half an hour, no charge, no salesperson. Bring the thing you have been quietly hoping is fine.
Would rather write?
Send this and we will reply, usually the same business day. No call unless you want one.
Protected by reCAPTCHA.