A staff member reports that files won't open. Screens show an unfamiliar message. A client calls to ask about a strange email from your company. However it begins, there is a moment when a business owner realizes something may be seriously wrong, and the decisions made in the following hour have a measurable effect on what the incident ultimately costs.
This guide is not technical. The technical response belongs to your IT team or provider. What follows are the actions and decisions that belong to you.
- Call your IT provider before doing anything else. Report exactly what was observed and when. If you have a managed provider, this call should reach a live person at any hour; that is part of what the relationship is for.
- Disconnect, don't power off. If ransomware is suspected, instruct staff to disconnect affected computers from the network (unplug the network cable, turn off Wi-Fi) but leave the machines running. Powering off can destroy evidence in memory that investigators need, and in some cases can make encrypted data harder to recover.
- Stop the spread of credentials, not just machines. Ask your provider to reset passwords and revoke sessions for affected accounts, starting with administrator, finance, and email accounts.
- Start a written timeline. A notebook is sufficient. Who noticed what, at what time, and what actions were taken. Insurers, investigators, and lawyers will all ask for this, and memory degrades within hours.
- Move sensitive communication off the suspect systems. If email may be compromised, coordinate by phone or personal text until your provider confirms otherwise. Discussing your response inside a mailbox the attacker can read hands them your playbook.
Call within the first hours
- Your cyber insurance broker or carrier. Most policies require prompt notification, and many provide an incident response team, legal counsel, and forensic specialists as part of coverage. Late notification is a common reason for coverage disputes.
- Legal counsel, for anything involving personal information. BC's Personal Information Protection Act and federal PIPEDA carry notification obligations when personal information is exposed. Counsel determines what applies; that determination is not one to improvise.
- Your bank, if payments or banking details are involved. Fraudulent transfers can sometimes be recalled if the bank is notified within hours. This call cannot wait for the investigation to conclude.
Do not
- Do not pay, promise, or negotiate anything on day one. Ransom decisions involve legal, insurance, and sanctions considerations, and they are made with counsel and your carrier, never in the first hours under pressure.
- Do not communicate with the attacker directly. If negotiation ever occurs, it is conducted by specialists your insurer engages.
- Do not announce the incident to clients or staff beyond need-to-know until the scope is understood. Communication will be necessary, and it should be accurate. Statements made before the facts are known frequently have to be corrected, which compounds the reputational cost.
- Do not let anyone "clean up" affected machines. Well-meaning staff reinstalling systems destroy the evidence that determines what was taken, which in turn determines your legal obligations.
The decisions only the owner can make
During an incident, technical staff will bring you choices rather than answers: whether to take systems offline during business hours, whether to operate on paper while recovery proceeds, when to inform clients, and what the business can afford in downtime versus risk. These are business judgments. Owners who have thought about them in advance make them in minutes; owners encountering them for the first time lose days, and days are where the cost accumulates.
The one-page preparation
Everything above becomes far easier with a single page prepared in advance and kept where a printed copy survives a system outage: the after-hours number for your IT provider, your insurance policy number and broker contact, legal counsel's number, your bank's fraud line, and the names of the two or three people authorized to make decisions if you are unreachable. Preparing that page takes an afternoon. Its absence, discovered at 6 a.m. on the day it is needed, is remembered for years.
Superion builds and tests incident response plans for businesses across Canada as part of our business continuity services, so the first hour runs from a plan rather than from improvisation. Contact us to put your one-page plan in place before it is needed.
