You arrive at work and files won’t open. A message on the screen demands payment. Your stomach drops. What you do in the next hour can decide whether this is a bad day or a business-threatening disaster.

Here is a practical checklist.

Minutes 0–10: Contain

Disconnect affected devices from the network. Unplug the network cable and turn off Wi-Fi. This stops the malware spreading to file servers and other computers.

Do not wipe or reinstall anything yet. Evidence on the machine helps investigators understand how the attack happened. Where possible, leave devices powered on but isolated, unless your IT provider advises otherwise.

Do not log in to anything else from an infected machine. Assume passwords typed there may be compromised.

Minutes 10–25: Alert the right people

– Call your IT provider or MSP immediately. Time matters.

– Notify your leadership team and decide who is coordinating the response.

– Contact your cyber insurance provider. Many policies require prompt notice and may provide a breach response team. Calling them first can protect your coverage.

Minutes 25–45: Assess and protect

– Identify what is affected. Which computers, servers, or cloud accounts show signs of encryption?

– Protect your backups. Disconnect backup drives and confirm that cloud backups are not being overwritten or deleted.

– Reset credentials for administrator accounts and email, from a device you know is clean.

– Disable compromised accounts if you can identify them.

Minutes 45–60: Document and plan

– Write down everything: what you saw, when, and what actions were taken.

– Take photos of ransom messages (don’t click links in them).

– Prepare to communicate. Decide how staff will be informed and who speaks to customers if needed.

– Don’t decide on paying the ransom in the heat of the moment. Payment doesn’t guarantee recovery, may fund further attacks, and can carry legal implications. Make that decision with advisors.

Reporting obligations

If personal information may have been exposed, Quebec’s Law 25 may require you to notify the Commission d’accès à l’information and affected individuals. You can also report the incident to the Canadian Centre for Cyber Security and your local police.

The best response is preparation

Businesses recover fastest when they have:

– Tested, offline or immutable backups

– Multi-factor authentication everywhere

– Up-to-date patches and endpoint detection

– A written incident response plan that everyone has read

DBR Soft helps businesses build that preparation before they need it. Contact us to review your backup and response readiness.