Emergency incident response
Under Attack?We Are On It.
Call our 24/7 incident line now. Follow these steps while our responders mobilize. The first hour decides the outcome.
- Incident line
- 24/7
- Retainer engagement
- 1 hour
- Provinces and territories
- 13
Incident line open
24/7/365Call now. We pick up.
- 1Disconnect affected machines (do not power off)
- 2Do not contact or pay the attacker
- 3Call your cyber insurer
- 4Preserve evidence and ransom notes
- 5Switch to phone, not email
Certified partner of
24/7 incident line
Call Now. Then Work Through the Steps Below
+1 236 665 1165Answered 24/7. Use a phone that is not on the affected network.
- Active incident
- Call. Do not use the enquiry form or email for an incident in progress.
- Retainer clients
- Remote engagement within 1 hour of your call, 24/7.
- Across Canada
- All 13 provinces and territories.
The first hour
Do This While Our Responders Mobilize
Six steps, in order. Tick them off as you go if it helps; nothing you tick is saved or sent.
0 of 6 steps done.
When you call
What Cyberphore Does from the First Call
Our responders triage the incident, contain the threat, investigate scope and root cause, and help you recover safely.
- 01
Triage
We assess what is happening, how far it may have spread and what needs containing first.
- 02
Contain
Stop the spread, secure accounts and preserve evidence before anything is wiped or rebuilt.
- 03
Investigate
Scope and root cause: how the attacker got in, what they touched and whether personal information was affected.
- 04
Recover
Restore systems safely from clean sources and verify the attacker is gone before reconnecting.
We Coordinate with the People You Already Rely On
We work with your insurer, legal counsel and IT provider, and preserve evidence to a standard that supports claims and regulatory reporting.
Your cyber insurer
Notice, approved vendors and claim evidence
Your legal counsel
Notification decisions, based on our technical findings
Your IT provider
Rebuilding and restoring, in the right order
Retainer Clients
Terms are agreed in advance, so no time is lost on contracts. Remote engagement begins within 1 hour of your call, 24/7.
Incident response retainersHave ready
What Helps on the First Call
Do not wait to gather all of it. Call first; whatever you have helps responders scope the incident faster.
- A phone that is not on the affected networkIf email or Teams may be compromised, call and coordinate from a separate device or channel.
- Your timeline so farWhat you noticed, when, and who has done what since. Rough notes are fine.
- Photos of ransom notes and error messagesTaken on a phone, without touching or deleting anything on the affected machines.
- What looks affectedThe computers, servers, accounts or mailboxes you know or suspect are involved.
- Your cyber insurance detailsPolicy number and the insurer’s claims contact. Your insurer may direct which response firm you use.
- Your key contactsWho decides for the business, plus your IT provider and legal counsel, so we can coordinate with them.
Common incidents we handle
The Incidents We Respond to Most
Ransomware and data extortion
Ransomware protectionBusiness email compromise and payment fraud
Microsoft 365 securityMicrosoft 365 and Google Workspace account takeover
Microsoft 365 securitySuspected data breaches involving personal information
Privacy complianceMalware infections and compromised servers or websites
Incident responseNot sure what you are dealing with?
Call anyway. Working that out is the first part of triage.
+1 236 665 1165
Privacy breach reporting in Canada
If Personal Information Is Involved, Reporting May Be Required
Organizations subject to PIPEDA must report breaches of security safeguards that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notify affected individuals. Provincial laws may also apply.
General information, not legal advice.
- Your legal counsel
- Confirms your reporting and notification obligations.
- Cyberphore
- Provides the technical findings they need: what was accessed and whether personal information was affected.
Prepare before it happens
Ask About an Incident Response Retainer
An incident response retainer gives you priority access and a tested plan, so the next incident starts with a call, not a contract.
- Terms agreed in advance
- Remote engagement within 1 hour of your call, 24/7
- A tested plan, so your team knows what to do on the worst day
This form is not for active incidents. If you are under attack now, call +1 236 665 1165.
Non-urgent enquiries only