Take a breath. Most incidents at small businesses can be contained in the first hour if you do things in the right order. Pick what's happening and follow the steps. Print this page now so you have it if your computer isn't usable.
Three rules for every situation
Use a different, clean device (your phone, or a computer you trust) to change passwords. A hacked computer can capture new ones.
Don't delete anything yet. Emails, messages and files are evidence for your bank, insurer and police. Take screenshots and write down times as you go.
Money first. If money has moved or might move, call your bank before anything else. The first hours decide whether it can be stopped.
Someone got into our email account
Right now (first 15 minutes)
From a clean device, change the account's password to a new one you've never used anywhere.
Sign out every session: Microsoft 365 (account settings, "Sign out everywhere") or Google ("Security", "Your devices", sign out of all).
Turn on two-step verification (an authenticator app is best) if it isn't already.
Next hour
Check for forwarding and inbox rules. Attackers add rules that forward or hide email (often anything with "invoice" or "payment"). Delete any you didn't create.
Check Sent and Deleted items for messages you didn't send, especially to customers and suppliers about payments.
If fake messages went out, warn those contacts by phone: don't trust email until it's secure.
Change the password on any other account that used the same password, starting with your bank and your domain registrar.
After
If customer or staff personal information could have been seen, see privacy reporting below.
Run the free Email Security Check so fakes of your address are easier to block next time.
Customers got fake invoices or payment requests from "us"
Right now
Call the customers who received it. Tell them not to pay, and that you'll never change bank details by email.
Look at the sender's address carefully. Paste the email's headers into the Fake Email Detector: it tells you whether it came from your real account (follow hacked email) or a copycat.
If it came from a copycat domain (like yourc0mpany.ca), find others with the Lookalike Domain Finder.
Next hour
Report the copycat domain to its registrar's abuse contact (any WHOIS lookup shows it). Include the scam email as evidence.
Send a short note to all customers: "We will never change our banking details by email. Call us on [your known number] to confirm any request."
Report it to the Canadian Anti-Fraud Centre (contacts below).
After
Turn on DMARC so emails faking your exact address get blocked: the Email Security Check shows how.
We sent money to a scammer
Right now: minutes matter
Call your bank's fraud line (the number on your card or the bank's website, not one from the email). Ask them to recall or freeze the payment. Have the date, amount and receiving account ready.
If you paid by gift cards, call the card company's number on the back of the card and give them the card numbers.
If you paid by credit card, call the card issuer and dispute the charge.
Next hour
Report it to your local police (non-emergency line) and get a report number. Banks and insurers often ask for it.
Report it to the Canadian Anti-Fraud Centre.
Tell your insurer if you have cyber or crime coverage. Many policies need notice quickly.
Work out how the scammer knew who to target: a hacked email account is the usual reason. Follow hacked email steps if anything looks off.
Our website has been hacked
Right now
Call your web host or web developer. Ask them to put the site in maintenance mode or take it offline while it's cleaned.
From a clean device, change the passwords for your hosting account, website admin (for example WordPress), and FTP or database if you have them.
Next hour
Ask your host about restoring a clean backup from before the problem started.
Remove admin users you don't recognise, then update WordPress, every plugin and theme. Delete plugins you don't use.
If you take payments on the site, tell your payment provider: card details may have been skimmed.
After
If Google shows a warning on your site, request a review in Google Search Console once it's clean.
Run the Website Security Check and fix what it finds so it's harder to break into next time.
Files are locked and there's a ransom demand
Right now
Unplug affected computers from the network (pull the cable, turn off Wi-Fi). Don't turn them off: what's in memory can help investigators.
Disconnect backup drives and shared drives so they don't get locked too.
Don't pay, and don't contact the attackers yet. Paying doesn't guarantee your files back and marks you as a target.
Take a photo of the ransom note.
Next hour
Call your IT provider. If you don't have one, your cyber insurer usually has an emergency response line.
Report it to the Canadian Centre for Cyber Security and your local police.
Check whether your backups are offline and untouched. Restoring from a clean backup is usually the way back.
After
If customer or staff personal information could have been taken, see privacy reporting.
Do we have to report it?
Under Canada's private-sector privacy law (PIPEDA), if personal information you hold was lost, stolen or accessed and it creates a real risk of significant harm to someone (for example ID theft or financial loss), you must report it to the Office of the Privacy Commissioner, tell the affected people as soon as you can, and keep a record. Keep a record of every breach, even small ones. If you're not sure, ask a lawyer or your insurer.
Who to contact in Canada
Your bank's fraud lineOn your card or the bank's own website. Call first if money moved.
Canadian Centre for Cyber SecurityCyber incidents, including ransomware: cyber.gc.ca
Office of the Privacy CommissionerBreaches of personal information: priv.gc.ca
Local policeNon-emergency line, for a report number. Call 911 if anyone is in danger.
Once it's under control
Most attacks start with gaps you can see from the outside: email that's easy to fake, an outdated website, a forgotten subdomain, a copycat domain. Check yours for free, then let Ongoing Protection watch them every day.
Belvic Group · Beltus Bejanga, SOC Analyst & Threat Hunter · [email protected] · 1-456 Carlton Street, St. Catharines, ON L2M 4X1 · Privacy · Terms General guidance, not legal advice or emergency response. For an active incident, involve your IT provider, bank and insurer.