Ransomware Protection for Ontario Businesses: 2026 Defence Guide
Two halves: the controls that make ransomware survivable, with a concrete backup isolation spec, and the first hour if it happens, including who in Canada and Ontario you may need to call.
Reviewed by the ITRS security team · Last updated
How often it actually happens
Statistics Canada found that 13% of Canadian businesses impacted by a cyber security incident in 2023 experienced ransomware, up from 11% in 2021, and 88% of those victims did not pay. The survey covers firms with 10 or more employees. Ransomware is less common than fraud, but when it lands it stops the whole business, which is why it deserves its own plan.
Prevention that matters most
Ransomware crews mostly get in through stolen passwords, exposed remote access and unpatched internet-facing systems. These controls address those routes directly.
- MFA on email, VPN, remote desktop gateways and every admin account. See the MFA guide.
- No remote desktop (RDP) open to the internet. Put remote access behind a VPN or gateway with MFA.
- Patch firewalls, VPN appliances and anything internet-facing within days of a critical fix, not at the next monthly cycle.
- Endpoint detection and response (EDR) on every computer and server, with someone actually watching its alerts.
- Separate admin accounts; nobody browses or reads email as a domain or Global Administrator.
- Third-party remote access tools (vendor support, your old IT provider) inventoried and removed if unused. Our third-party remote access policy covers this.
Backup isolation spec
Attackers look for backups first and delete or encrypt them before launching the ransomware. A backup that the same admin password can reach is not a ransomware backup. Use this as a minimum spec to give your IT provider.
| Requirement | Minimum | How to verify |
|---|---|---|
Copies | At least 3 copies on 2 types of media, 1 offsite or offline | List them, with locations |
Immutability | At least one copy immutable or offline for 14 days or more | Try to delete a recent backup with an admin account; it should refuse |
Separate credentials | Backup console uses accounts not in your Windows domain or Microsoft 365, with their own MFA | Show the login method |
Network separation | Backup storage not mapped as a drive or reachable over SMB from user machines | Check from a normal PC |
Coverage | Servers, line-of-business databases, Microsoft 365 or Google data, firewall configs | Compare backup list to asset list |
Restore test | Quarterly, including one full server or VM | Restore-test log with times |
The first hour
The Canadian Centre for Cyber Security ransomware playbook is the federal reference. In practice, the first hour for a small business looks like this.
Isolate, do not power off
Unplug network cables and turn off Wi-Fi on affected machines. Leave them powered on if you can: memory and logs are evidence.
Stop the spread
Disable the accounts that appear compromised, and the VPN if it may be the way in. Do not delete anything.
Call for help
Your incident response provider, then your cyber insurer's breach line before you engage anyone else; many policies require it. Our 24/7 incident line is (289) 582-9930.
Preserve evidence
Photograph the ransom note. Do not contact the attackers or run cleanup tools yet. Our ransom note on screen page goes step by step.
Start a log
Times, who did what, which machines. You will need it for the insurer, the police and possibly a regulator.
Who to tell in Canada and Ontario
| Who | When | Link |
|---|---|---|
Canadian Centre for Cyber Security | Voluntary report of the incident; can provide advice | |
Local police and the Canadian Anti-Fraud Centre | Criminal report; insurers often ask for a police file number | |
Your cyber insurer | Immediately, per your policy | Policy wording |
Office of the Privacy Commissioner of Canada | If personal information was involved and the breach creates a real risk of significant harm (PIPEDA) | |
Information and Privacy Commissioner of Ontario | Health information custodians under PHIPA, where the reporting thresholds are met | |
Affected individuals and organizations | As soon as feasible once a real risk of significant harm is determined (PIPEDA) | With counsel |
Paying the ransom
That is a business and legal decision for the owner, counsel and insurer, not the IT provider. Know that payment does not guarantee working decryption or deletion of stolen data, and that data theft before encryption is now common. Good backups are what make 'no' a realistic answer.
Not legal advice: confirm reporting obligations with counsel. For investigation and recovery support, see ransomware response.
Related reading.
- ServiceRansomware responseA plain sequence for a 20 to 200 person organization hit by ransomware: isolate, preserve, scope, recover, assess data theft and notify, with evidence kept intact for…
- GuideWhat to do if you see a ransom note on a screenFor whoever sees it first. Print this page and post it near your reception desk and server room: the first 15 minutes after a ransom note appears shape everything that…
- ArticleReal risk of significant harm: how the assessment worksWhether a Canadian privacy breach must be reported usually turns on one judgment: does it create a real risk of significant harm? The legal test is short.
- ArticleCloud Backup and Disaster Recovery: A Practical Guide for GTA BusinessesWhat Microsoft 365 and other cloud services keep for you, what they do not, and how to set up and prove a backup that covers the gap.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.