Ransomware remains the top cybercrime threat to Canadian organizations, and small and mid-sized businesses are squarely in the crosshairs. Attackers know SMBs run lean IT, and they price their ransom demands accordingly. The good news: with the right preparation, a ransomware incident becomes a recoverable event instead of an existential one. This ransomware recovery playbook walks through what to do before, during, and after an attack.

Before an attack: the three controls that matter most

• Tested, offline backups. A backup you have never restored is a hope, not a plan. Keep at least one copy immutable or offline so it cannot be encrypted along with production systems, and test restores quarterly.
• Multi-factor authentication everywhere. Most intrusions still begin with a stolen password. MFA on email, VPN, and remote access closes the most common door.
• Patch the perimeter first. Firewalls, VPN appliances, and anything internet-facing should be updated within days of a vendor advisory, not months.

The first 24 hours after discovery

1. Isolate, don’t power off. Disconnect affected machines from the network but leave them running to preserve forensic evidence.
2. Activate your incident plan. Know in advance who declares the incident, who calls your insurer, and who communicates with staff.
3. Report it. Notify the Canadian Centre for Cyber Security and local police. If personal data was exposed, you may have obligations under PIPEDA and BC’s PIPA.
4. Restore from clean backups onto verified-clean infrastructure — never restore on top of a compromised environment.

Should you pay?

Statistics Canada’s most recent Survey of Cyber Security and Cybercrime found that 88% of Canadian ransomware victims did not pay — and law enforcement advises against it. Payment funds the next attack, and there is no guarantee of working decryption keys. A strong recovery posture is what removes the leverage.

Recovery is a team sport

OPUS Consulting Group designs and operates exactly this kind of resilience for Lower Mainland businesses: monitored backups with tested restores, managed security, and a support desk open 6:00 AM to 11:00 PM Pacific, seven days a week. If you would like a ransomware-readiness review of your current environment, call 1-866-800-OPUS (6787) or contact us.

The first hour: containing a ransomware attack

• Isolate affected machines from the network immediately — unplug or disable Wi-Fi — but do not power them off, as memory can hold useful forensic evidence.
• Disable compromised accounts and rotate credentials, starting with anything used for remote access.
• Call your IT provider and, where appropriate, report the incident to the Canadian Centre for Cyber Security and local authorities.
• Preserve evidence and avoid wiping systems until the scope is understood.

Recovering without paying the ransom

With tested, isolated backups you can rebuild rather than negotiate. The sequence is: confirm the backups are clean and predate the intrusion, stand up clean infrastructure, restore data, force an organization-wide password reset, and only then reconnect. Paying is never a guarantee — decryptors are often slow or incomplete, and paying marks you as a willing target. A solid data backup strategy is what makes “don’t pay” a realistic choice.

Preventing the next attack

Recovery buys survival; prevention buys peace of mind. Layered cyber security — endpoint detection, email filtering, MFA, network segmentation, and ongoing patching — dramatically lowers the odds of a repeat. Most SMBs get there fastest with managed IT that monitors and maintains these controls continuously.

Worried about ransomware, or recovering from an incident in Vancouver? Contact OPUS Consulting Group or call 1-866-800-OPUS (6787).

chat, comments, content