Private Client Incident Response

A cyber incident at a company has an IT department, a legal team and a communications plan. When the target is a family member, the incident lands on a personal phone, a home network or a teenager's social media account, and the people affected are frightened and embarrassed. The work is the same in principle: contain it, keep the evidence, recover access and close the route in. The handling has to be quieter and more careful.

We keep the circle small. Only the people working on the matter know about it, nothing is discussed outside the household and its advisers, and the record of what happened belongs to the family. Where lawyers or police become involved, we preserve evidence in a way they can rely on.

1. 01

   Account takeover

   A family member's email, Apple or Google account, or social media has been taken over. We recover it from a clean device, sign out other sessions, check recovery details, forwarding rules and linked apps, and look for what else the attacker could reach from it.

2. 02

   Sextortion and impersonation

   Someone is threatening to share intimate images, or a fake account is impersonating a family member to friends, colleagues or the public. We help preserve the messages and profiles, secure the real accounts, and support reporting to the platforms and police.

3. 03

   SIM swap

   A phone suddenly loses service and sign-in codes stop arriving. We work with the family to get the number back through the carrier, then move important accounts off text-message codes and check banking and email for changes made while the number was gone.

4. 04

   Home network compromise

   Unknown devices on the Wi-Fi, a router with changed settings, or cameras behaving oddly. We capture what is needed, rebuild the network on clean equipment and settings, and separate family, guest and smart home devices.

5. 05

   Stalkerware on phones

   Signs that someone knows where a family member is or what they are saying. We check devices and linked accounts carefully, with safety planning first, because removing monitoring software can alert the person who installed it.

These steps help in almost every personal incident. If you are unsure, call before acting.

• Call the 24/7 incident line at (289) 582-9930.
• Use a device you trust to make calls and change passwords, not the one you think is affected.
• Do not delete messages, accounts or apps. Screenshots and original messages are evidence.
• If money is involved, call your bank or card issuer using the number on the back of the card.
• If anyone's physical safety is at risk, call 911 first.

Cybertip.ca, operated by the Canadian Centre for Child Protection, describes sextortion as blackmail: a threat to share a sexual image or video unless the victim pays or sends more content. Its advice to young people is to stop talking to the person, screenshot the messages, never pay and never send more, block the account, and get help from a safe adult or police. It notes that responding makes the harassment worse.

If a minor is involved, report to Cybertip.ca and police. Adults can report to police and to the Canadian Anti-Fraud Centre at 1-888-495-8501 or through reportcyberandfraud.canada.ca. We help families collect and preserve what those reports need, and deal with the accounts and devices while they do.

Monitoring apps hidden on a phone, a shared account that reports location, or a tracker in a bag or car can all give someone else a view of a family member's movements and messages. If the person responsible is close to the family, removing the software or changing passwords without a plan can tip them off and escalate the situation.

We start by agreeing a plan with the person affected and, where appropriate, with police or a support organization. Only then do we examine the device, document what we find and remove access in an order that keeps them safe.

1. 01

   Close the route in

   Passkeys, security keys or authenticator apps on important accounts, the carrier's extra account protection, and recovery details that only the owner controls.

2. 02

   Check the rest of the household

   Attackers often move from one family member to another through shared accounts, family sharing groups and contacts.

3. 03

   Write it down

   A short, private record of what happened, what was changed and what to watch for, kept by the family.

4. 04

   Reduce exposure

   Where personal details made the attack easier, we file removal requests with data brokers that accept them.