Ransomware: What to Do in the First 24 Hours, Hour by Hour

Tuesday, 6:50 a.m. The operations manager of a 40-person engineering firm in Gatineau is first in the door. None of the screens behave normally. On the file server sits a new document: README_RESTORE.txt.

What happens over the next 24 hours will weigh heavily on everything after: a few days of downtime, or several weeks. The right moves are simple. They just have to happen in the right order.

Here is that plan, hour by hour. Print it before you need it.

The plan at a glance

Minute 0 to 60: contain without destroying

The Canadian Centre for Cyber Security's ransomware playbook is blunt: isolating systems is the most important course of action.

• Isolate affected devices. Unplug network cables and turn off Wi-Fi. If you can isolate them, leave them powered on: memory holds clues. If you can't, shut them down rather than let the infection spread.
• Shut down remote access: VPN, Remote Desktop, your IT provider's remote tools and exposed cloud accounts.
• Switch channels. Assume the attacker can still read your email and company chat. Move to cellphones and a messaging service outside the affected environment.
• Photograph the ransom note and the screens. Write down the time of everything you observe.
• Don't click the link in the note, and don't contact the criminals.
• Don't wipe or reinstall anything. Logs will show how far the attacker got.

Hours 1 to 4: mobilize the right people

Call your cyber insurer's breach hotline first. Many policies require you to use their incident response firms. Hiring someone else before calling them can complicate your claim.

Then:

1. Your IT provider, to carry out the isolation and preserve access.
2. A specialized incident response firm, often supplied by the insurer. It runs the technical investigation.
3. Your legal counsel, ideally from the start, to steer notifications and communications.
4. A small crisis team: one decision-maker, IT, whoever handles communications and your privacy officer.

Start a decision log: time, decision, who made it. Your insurer, investigators and regulators will all want it. If you have an incident response plan, this is the moment to pull it out: the names and numbers are already in it.

Hours 4 to 12: understand the scope

Working with the response firm, aim to answer four questions.

• What is encrypted? Servers, laptops, NAS devices, cloud services.
• Are the backups intact? Check the offline copy without plugging it into the infected network. Attackers often go after backups before they encrypt.
• Was data stolen? Many groups copy data before encrypting, then threaten to publish it. Our article on the anatomy of a ransomware attack explains this double extortion.
• How did the attacker get in? A VPN account without MFA, a booby-trapped email, an unpatched server? As long as that door stays open, restoring is pointless.

Resist the urge to rebuild everything tonight. The Cyber Centre recommends resetting credentials, creating temporary admin accounts for recovery and scanning backups before restoring them.

Hours 12 to 24: notify and communicate

Police. Report the attack to your local police: the SPVM, Sûreté du Québec, OPP or your municipal force. The Cyber Centre recommends doing so within 24 hours of discovery and keeping the report number.

Canadian Centre for Cyber Security. Report the incident online. The Cyber Centre isn't a police agency, but it provides advice and support. Don't fill out the form from a device you believe is compromised.

Canadian Anti-Fraud Centre. Report the attack on the federal Report Cybercrime and Fraud platform as well, or call 1-888-495-8501.

Privacy law. If personal information may have been accessed or stolen, Quebec's Law 25 treats it as a confidentiality incident. You must take reasonable steps to reduce the risk of injury, record it in your register (s. 3.8) and, if it presents a risk of serious injury, promptly notify the Commission d'accès à l'information and affected individuals (s. 3.5). There is no fixed 72-hour deadline. Our guide to reporting a confidentiality incident to the CAI covers the assessment, and Cyberattack: who to notify in Canada covers everyone else. Confirm with legal counsel.

Staff. A short message: what's happening, what you need from them and no posts on social media.

Clients and suppliers. Facts, not speculation, coordinated with your insurer and counsel.

To pay or not: what the Cyber Centre says

The Cyber Centre doesn't decide for you: the call belongs to your organization. But it is clear about the risks.

• Paying will not guarantee access to your encrypted data or systems.
• Criminals may demand more, leak or sell the data anyway, or target you again.
• Every payment funds new attacks.
• Before you even consider paying, report the crime to local police.

Never decide alone, and never in the first few hours. Payment can raise legal questions too, so bring in your insurer and legal counsel. The only real way to avoid the question is a tested offline backup.

After the first 24 hours

Recovery takes time. According to CDW's 2025 study, small Canadian organizations take an average of 25.7 days to recover from an incident. According to industry data cited by Insurance Business Canada (October 2025), a ransomware incident costs $330,000 on average. To shorten what comes next:

• The entry point is identified and closed.
• Every admin password is reset and protected by MFA.
• Affected machines are rebuilt from a clean image.
• Backups are scanned before being restored.
• The incident register is complete and required notices are sent.
• A lessons-learned meeting updates the response plan.

Once the crisis is over, our remediation and hardening services help close the gaps in the right order, starting with the ones the attacker used.

The best time to read this page is today. Write your insurer's emergency number and your IT provider's number on paper.