Take a breath.

It’s possible that you’re reading this because your Canadian business just went through a cyber security incident (maybe it was a suspicious email that got clicked, data that suddenly “went missing,” or accounts that don’t look right). We understand that you want a solution, and FAST.

You’re not alone. And you’re not the first Canadian business to be here.

At Joe Apps, we’ve helped small businesses across Ontario and BC through exactly this moment: the “What do we do now?” moment. The good news? There is a process. You don’t need to panic. You need a plan.

If you’re in the middle of an incident and need hands-on help right now, you can call Joe Apps and we’ll step in. 

But if you’re trying to understand the steps, let’s walk through them calmly, one at a time.

Step 1: Don’t Ignore It. Contain It.

The first instinct for a lot of people is to hope it’s nothing. Close the window. Restart the computer. Pretend it didn’t happen.

Don’t do that.

If you suspect a cyber incident – strange logins, ransomware messages, missing files, or unusual account activity – your first job is containment, not cleanup.

Think of it like discovering a leak in your office: you don’t repaint the wall first. You shut off the water.

Practical containment steps may include:

  • Disconnecting affected devices from the network (Wi-Fi and wired)
  • Logging out of cloud services on suspicious devices
  • Temporarily disabling remote access, if it’s being abused
  • Changing passwords from a clean device (not the suspicious one)

The Canadian Centre for Cyber Security recommends isolating affected systems quickly to limit damage and prevent spread. That’s your priority right now: stop things from getting worse.

If you’re unsure which devices to disconnect or which accounts to lock down, this is exactly where Joe Apps can jump in and guide those first decisions with you.

Step 2: Record What You See – Don’t Wipe It Away Yet

It’s tempting to “clean everything up” as fast as possible. But wiping things too early can destroy important information. Ask yourself the following questions and document as much as you can:

  • What did you notice first?
  • When did it start?
  • Which devices, accounts, or systems are affected?
  • Have you seen any error messages or ransom notes? (Screenshots help.)

The Cyber Centre encourages businesses to keep detailed records of incidents for follow-up and learning. That starts now – even if it’s just a few bullet points in a notebook or email draft.

When you call our cybersecurity experts at Joe Apps, we’re going to ask for you to tell us exactly what you saw. The more you remember, the faster we can help

Step 3: Protect Your People and Your Data

Once you’ve contained the immediate issue, the next step is protecting what matters most: your people and your data. Take these steps to get things back on track:

  • Reset passwords for affected accounts (email, banking, cloud tools, admin portals).
  • Turn on multi-factor authentication (MFA) if it isn’t already in place.
  • Confirm that backups exist and check when they last ran.
  • Avoid using affected systems until they’ve been assessed.

Step 4: Assess the Damage (With Help if You Need It)

Work with your internal team or a professional cybersecurity team like ours at Joe Apps to answer the following questions:

  • What exactly happened? (Knowing the terms to describe this can help, and we wrote an article on common cybersecurity terms to help with that)
  • How far did it spread?
  • What data was accessed, modified, or deleted?
  • Is there evidence the attacker still has access?

We use tools and processes to:

  • Scan systems for malware and backdoors
  • Check logs for unusual activity
  • Confirm whether backups are clean and usable
  • Determine if data was exfiltrated or just encrypted/locked

It’s like having a mechanic look over your car after a crash. You don’t just want to know that something broke. You want to know what broke and what it will take to fix it.

Step 5: Recover Safely – Don’t Just Turn Everything Back On

Recovery isn’t just “turn it off and on again.”

Once you understand the scope, you can start restoring your systems from clean, verified backups. This often means:

  • Wiping affected machines
  • Restoring data from backups
  • Verifying that restored systems are fully patched and updated
  • Re-enabling remote access and services after they’re secured

We recommend restoring from trusted backups and ensuring systems are fully secured before reconnecting them to your network. It’s a bit like disinfecting a room before letting people back in.

Joe Apps handles this end-to-end for many clients: from backup validation to full restore and testing. The goal isn’t just “get it working again” – it’s “get it working safely.”

Step 6: Decide Who to Notify, and When

Depending on what happened, you may have reporting obligations.

If personal information was involved, or financial or criminal activity occurred (like fraud or ransom demands), you’ll need to file a report to the relevant authorities.

You don’t have to decide this alone. This is where your leadership, legal support, and IT team (or Joe Apps) work together.

We can help you assess whether a cyber incident crosses the threshold of a “breach” under Canadian law – and if so, how to communicate it clearly and professionally.

Step 7: Learn From It and Close the Gaps

Once the smoke clears, there’s one more crucial step: turning this incident into a turning point.

  • We walk clients through questions like:
  • What allowed this to happen?
  • Was it a missing update? Weak password? No MFA? Human error?
  • What processes or tools do we need going forward?

From there, put long-term protections in place:

  • Better backups
  • Stronger passwords and MFA
  • Security training for staff
  • Patch management
  • Improved monitoring

You Don’t Have to Handle Cyber Incidents Alone – Joe Apps Is Here for Canadian Businesses

Joe Apps helps small businesses across Ontario and BC respond to and recover from Canadian cyber incidents calmly, systematically, and securely. From containment to cleanup to long-term protection, we’re your tech support and cybersecurity partner – not just when things go wrong, but to help prevent the next problem before it starts.

If you’re dealing with an incident right now – or want a plan in place before one happens – reach out to Joe Apps today. We’ll help you turn panic into a clear, confident path forward.