Cyberattack: Who to Notify in Canada, and in What Order

Tuesday, 6:15 a.m. The warehouse supervisor at a Laval food distributor walks in to find every workstation showing the same ransom note. By 6:40, the owner has three people on the phone and one question on repeat: “Who do we call first?”

In the first hours of a cyberattack, the order of your calls matters as much as what you say. Calling the wrong party too early can jeopardize your insurance coverage. Waiting too long can let a wire transfer slip away or put you offside the law.

Here is a roadmap for a Canadian small business, with Québec specifics, to adapt with your advisors.

Before the first call: who decides and who speaks

An attack triggers a panic reflex: everyone calls everyone. Before anyone picks up the phone, assign three roles.

• An incident coordinator who runs the response and keeps a time-stamped log of every action.
• Your privacy officer, whom Law 25 requires you to consult when assessing the risk of injury.
• A single spokesperson for clients, partners and media.

Assume the attacker can read your email. Use phone calls, personal cell phones or a messaging tool outside the company domain. For the technical moves of the first hours, see our guide Ransomware: the first 24 hours.

The order of calls in the first hours

1. Your bank, if money is involved. Fraudulent wire transfer, access to bank accounts: every hour lowers the odds of freezing or recalling the funds.
2. Your cyber insurer. Many policies require prompt notice and use of their breach hotline and approved vendors. Hiring a response firm on your own can complicate reimbursement. Reread your policy today.
3. Your IT provider or an incident response firm, ideally the one your insurer designates, to contain the attack and preserve evidence.
4. Police, especially for extortion or fraud.
5. The regulators and affected individuals (the CAI in Québec, the OPC where PIPEDA applies) once your assessment meets the legal threshold.
6. Clients and partners covered by a contractual clause, then the Canadian Centre for Cyber Security.

The notification table: who, when, how, why

If payment card data is involved, add your acquirer, as your merchant agreement requires.

Law 25 and PIPEDA: two tests, two regimes

Law 25 governs private businesses in Québec. Its test is a risk of serious injury, assessed on the sensitivity of the information, the anticipated consequences and the likelihood of injurious use (s. 3.7). Our guide to reporting a confidentiality incident to the CAI covers what the notice must contain.

PIPEDA, the federal law, can also apply: federally regulated businesses, organizations in provinces without their own private-sector privacy law, or personal information disclosed across provincial or national borders in the course of commercial activity. Its test is a real risk of significant harm, and it requires reporting to the Commissioner and notifying individuals as soon as feasible (s. 10.1). Alberta and British Columbia have their own private-sector privacy laws, so check those too if you operate there.

Both regimes require a record:

• Law 25: every confidentiality incident, reported or not, kept for at least five years. Our incident register template saves you time.
• PIPEDA: every breach of security safeguards, kept for at least 24 months.

As for the Critical Cyber Systems Protection Act (Bill C-8), it targets only designated operators in finance, telecommunications, energy and transportation, and it was not yet in force as of September 2026.

What not to do during those calls

• Don’t say “no data was affected” until the analysis proves it.
• Don’t negotiate with the attacker on your own. Don’t reply to the ransom note before talking to your insurer and the police.
• Don’t wipe or reinstall affected machines before evidence is preserved.
• Don’t communicate through the compromised email system.
• Don’t let each employee warn “their” clients with their own version of events.

Build your call list today

The worst time to look for your insurer’s breach hotline is when your servers are encrypted. Print this list and keep a copy off the network:

• Policy number and breach hotline for your cyber insurer
• Your bank’s fraud line and your account manager’s name
• Local police non-emergency number
• Name and cell number of your privacy officer
• Contacts for your IT provider and incident response firm
• Legal counsel
• Links to the CAI, Cyber Centre and, where relevant, OPC reporting forms
• A list of client contracts with notification deadlines
• Notice templates for affected individuals, ready to adapt

This list belongs in your incident response plan, tested at least once a year.

This guide explains your obligations in plain language and is not legal advice: validate every notification decision with your legal counsel. Our Law 25 compliance support can help you build the procedure and the injury assessment grid before you need them.