Ransomware response

Files that will not open and have a new extension, a ransom note on desktops or file shares, servers that suddenly go dark, or a threatening email claiming your data has been stolen. Sometimes the first sign is earlier: backups failing, unexplained admin accounts, or security tools switched off overnight.

The Canadian Centre for Cyber Security's ransomware playbook (ITSM.00.099) and the joint CISA #StopRansomware Guide both put isolation first. In practice, the first hour looks like this:

1. 01

   Disconnect, don't power off

   Unplug affected machines from the network or disable Wi-Fi. Leave them on where you can: memory can hold encryption keys, attacker tools and network connections that disappear on shutdown.

2. 02

   Protect the backups

   Take backup systems offline or confirm they are isolated. Attackers routinely target backups before encrypting.

3. 03

   Call your insurer's claims line and counsel

   Many cyber policies have notice requirements and rules about which vendors you can use. Read the notice clause before you sign anything.

4. 04

   Start a written log

   Who noticed what, when, and every action taken since. Times matter later.

5. 05

   Don't contact the attacker

   Do not reply to the note or visit the leak site from a company device. That decision belongs to leadership with counsel.

The instinct is to wipe and rebuild immediately. Doing that before evidence is captured often means you can never answer how the attacker got in, how long they were there, or whether data left the network, which are exactly the questions your insurer, regulators and clients will ask.

We contain in a way that keeps the record: disabling compromised accounts and resetting privileged credentials, blocking attacker infrastructure at the firewall, isolating segments, and capturing memory and disk images of key systems (domain controllers, file servers and the first machine affected) before any rebuild. Every item collected is logged and hashed so its integrity can be shown later, in line with ISO/IEC 27037 practice.

Scoping answers three separate questions. They are often confused, and each needs its own evidence.

Recovery is planned, not improvised. We help your IT team or ours decide between restoring from backup, rebuilding clean, or a mix, based on what the scoping found. Restoring a system with the attacker's persistence still in it is a common way to be hit twice.

Before restored systems go back into production we check that backups pre-date the intrusion, rebuild identity infrastructure where it was compromised, rotate credentials (including service accounts and the krbtgt account in Active Directory), and confirm monitoring is in place to catch a return visit. The CCCS playbook's recommendation of multiple backups, including offline copies, becomes the post-incident baseline.

If counsel or an insurer is already involved, see forensics for breach counsel and insurers.

The Canadian Centre for Cyber Security says the decision is yours, but paying does not guarantee you get your data or systems back, attackers may run wiper malware after payment, and payments fund further crime. Report to police before you consider paying. Statistics Canada found 84% of Canadian businesses hit by ransomware in 2025 did not pay.

Whether to pay is a business and legal decision for leadership, counsel and your insurer. We do not negotiate with threat actors or facilitate payments. What we provide is the factual input that decision needs: whether working backups exist, how long a rebuild will realistically take, what data appears to have left, and whether the group involved is known for leaking regardless.

The Canadian Centre for Cyber Security notes that paying does not guarantee you will get your data back, and recommends reporting to police before considering payment. Sanctions and anti-money-laundering rules may also be relevant; that analysis belongs with counsel.

If personal information was involved, PIPEDA requires organizations to report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notify affected individuals, and keep records of all breaches. Provincial laws, sector regulators and contracts with clients can add their own obligations and timelines.

Our role is to give counsel defensible facts: a preliminary findings summary, then a final report with timeline, scope, evidence of data access or exfiltration (or the absence of it), and the limits of what the logs could show. Adjusters typically need the same facts plus a record of costs, so we track our time and actions to make that straightforward.

NIST SP 800-61 Rev. 3 (2025) treats lessons learned as part of continuous improvement, not a meeting at the end. We turn the root cause into specific changes:

• MFA on every remote access path, and removal of exposed RDP or unpatched VPN appliances
• Separate, MFA-protected admin accounts and fewer standing privileges
• Immutable or offline backups with a tested restore
• Endpoint detection and response with someone watching the alerts
• An updated incident response plan and a tabletop exercise to test it