519 672 2121
Close mobile menu

The first 24 hours following a data breach are probably the most critical for reducing potential damage, and protecting your brand. Call our 24-hour hotline immediately if you suspect you are experiencing a data breach: 800.816.9596.

Do we have a breach?

A lack of system performance or other abnormalities may be the result of user error, or a system configuration error. Although any anomalous system behaviour should alert you to the prospect of a data breach, and although certainty is not required, there should at least be some confidence that a real incident is underway.

Immediate Action Steps

Once the decision has been made that a data breach has occurred, the following steps should be implemented without delay:

1. Engage legal counsel experienced with data breach management

Siskinds acts as the “hub” to manage data breach incidents. We engage experienced service providers directly. The reasons are twofold. First, we engage service providers in whom we have confidence and with whom we have typically worked before. This cuts down considerably on the “time to get going.” Second, and most important, when we engage service providers directly, the reports and information that they produce and provide to us are privileged. This means that those materials are not subject to discovery in the event that litigation over the breach is subsequently commenced.

2. Commence record taking

The time and date of all discussions and key decisions should be documented throughout the event. The role of this record keeper should be identified in your Incident Response Plan (“IRP”).

3. Activate the Incident Response Team

All members of the Incident Response Team (“IRT”) should be notified using one or more of the contact methods identified in your IRP.

4. Engage forensics

The containment, eradication and recovery phases of the incident require the involvement of a skilled forensics team from the outset.

5. Secure the premises

If there is a defined area where the data breach occurred, it should be secured to prevent unauthorized access and the loss of any evidence. At the same time, a Command Centre for the IRT should be established and secured.

6. Stop additional data loss

Containment of the incident includes such measures as: disabling the network switch port to which a particular system is connected; blocking access to malicious network resources such as IP’s (at the firewall) and domain source specific URLs; temporarily locking a user account under the control of an intruder; disabling system services or software that an adversary is exploiting; and shutting down all Wi-Fi connections. Note that all machines should be left powered on[i], in order to preserve any cached memory.

In certain situations, your forensic advisor may advise that containment be skipped. With sophisticated adversaries, certain containment measures will alert them and cause them to implement new tools, establish secondary backdoors, or move to a destructive phase.

7. Continue record-keeping

Secure all logs, audits, notes, documentation and any other evidence that has or is gathered during the incident with appropriate identification marks, securing the chain of custody for future prosecution or litigation. All relevant system security/event/IDS logs should be maintained. Provide notice to your ISP or MSP that they preserve and maintain all logs.

8. Interview key persons

As part of the record-keeping process, all parties involved in the incident should be interviewed from time to time to gather their observations and input.

9. Consider notification requirements

Provincial and federal laws impose notification obligations to various governmental offices, the affected data subjects, and law enforcement and other agencies. Because of the short notification periods provided for under these laws, your legal obligations to disclose need to be assessed early on, and that assessment should be constantly updated.

10. Assess priorities and risks

Based on what you know at this point regarding your systems, the extent of the breach, the nature of the breach and other factors, priorities need to be established and other aspects of your response, including communications, need to be progressed.

11. Advise your insurer

If you have cyber insurance coverage, your broker or insurance company representative should be notified at the outset. This ensures that the response is conducted in accordance with the best practices established by the insurer.

12. Notify law enforcement

Law enforcement agencies are increasing their level of cooperation and information sharing. This means that information about the particular threat actor may be known to the police, which may assist the forensics team. In some instances, decryption keys for ransomware are known to law enforcement agencies who can then share that information. In the event of a criminal prosecution, law enforcement can assist with the preservation and storage of evidence.

[i] If your computer is compromised

  1. Disconnect it from the wired or wireless network. If using a docking station undock it and then turn off the wireless network as it will auto-switch to wireless when the wired network is no longer available.
  2. Do not turn off your computer.
  3. Contact your IT department and let them know the situation.

Our Team

Learn more about Stacey Bothwell.

Stacey Bothwell

Partner - Business Law
Learn more about Peter Dillon.

Peter Dillon

Partner - Franchise Law, Technology, Privacy, Cybersecurity
Learn more about Savvas Daginis.

Savvas Daginis

Associate – Business Law

Lawyers Across Our Firm

With over 80 lawyers who focus on diverse areas of the law, we can help you. Start here.

Find a Lawyer

I have experienced the relief every day since [we finished the matter]. Again, a big Thank You [Madison Goodacre] for getting this, most importantly done, but also quickly and professionally. - S.P.

Victoria [Edwards] and associates did a wonderful job and I would highly recommend your firm and Victoria. She explained all the details to perfection and very professionally. The satisfactory conclusion for this file speaks for itself. Thank you Victoria. You are the best! - J.I.

I want to thank Andrea [Cooley] so much for all her care, concern, work, expertise and wisdom that she gave over the last few months. A separation is something I did not really want to go through, but with Andrea's help I am thankful that I was able to get it all figured out and finished up. I am very happy that it is done, and I can move forward. - L.D.