After-Hours IT Problems: When to Call a 24/7 Incident Line

Call the incident line if any of these are true:

• A ransom note is on a screen, or files are being renamed or encrypted.
• Someone has entered a password on a fake login page, or a mailbox is sending mail nobody wrote.
• A server, the internet line or the phone system is down and staff are working now or first thing tomorrow.
• Money may have been sent to a fraudster, or a vendor's banking details were changed by email.
• A laptop or phone with company data has been lost or stolen.

If you have not written this down before, our incident contact sheet is a one-page template to fill in now and keep somewhere that is not on the company network.

• Your name, the business name and a call-back number.
• What you saw, when, and on which device. A phone photo of the screen helps.
• Whether anyone has already changed anything (passwords, unplugged machines, restarted the server).
• Who can approve decisions such as disconnecting a server or resetting the owner's account.

1. 01

   Is it urgent?

   We decide with you whether this is business-stopping or an attack in progress, or whether it can wait for business hours.

2. 02

   Stop it spreading

   For a suspected attack, the first instructions are usually about containment: unplug the network cable rather than shutting down, and do not reset passwords from a device that may be compromised.

3. 03

   Agree the next step

   Remote work starts if we have access and your approval. If we do not manage your systems, we tell you what access we need and what it will involve.

4. 04

   Write it down

   Times, actions and who approved them are recorded. That record matters later for your insurer, your lawyer or a regulator.

Most after-hours incidents leave work for the next business day. Expect to review what happened, fix the cause rather than the symptom, and check that backups and accounts are back to normal.

If personal information may have been exposed, someone has to decide whether the breach is reportable. Under PIPEDA, breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and the affected people. The Office of the Privacy Commissioner's breach guidance sets out the test. We give your lawyer or privacy lead the timeline; the reporting decision is theirs.

If you have cyber insurance, read the notice clause the same day. Many policies expect early notice and a call to the insurer's breach line before you hire outside help.

The incident line takes calls from businesses we do not support, including ones whose own IT provider is not answering. The emergency IT services page explains how that works.

For specific situations, the step-by-step guides are a good starting point while you wait: ransom note on screen, Microsoft 365 account hacked and sent money to a fraudster.

"24/7" means different things in different contracts. Before you rely on it, ask:

• Does an after-hours call reach a person who can act, or a voicemail that is checked in the morning?
• Is after-hours work included, or billed separately, and at what rate?
• Who can approve containment steps at night, and what happens if they cannot be reached?
• Is anyone reviewing security alerts outside business hours, or only answering the phone?

Our guide to 24/7 IT support in Toronto compares how providers structure after-hours cover and what it usually costs.