It's Monday morning. Coffee in hand, you sit down at your desk. Instead of your usual calming desktop wallpaper, your screen greets you with a bright red alert, a countdown timer, and a warning: your files are locked.
This is the moment every business owner dreads, and for Canadian organizations, it's happening more often… in fact, ransomware incidents rose an average of 26% year-over-year between 2021 and 2024, according to the Canadian Centre for Cyber Security. No business is "too small to be a target." Small and mid-sized companies are often seen as easier entry points — sometimes even a backdoor into the larger organizations they work with.
What happens in the first 24 hours after that message appears determines almost everything: how much data you lose, how long you're down, the financial toll, and the cost to your reputation. There are generally two paths from here, with very different outcomes.
So, we're going to walk through two simplified versions of the same attack:
- One business has no incident response plan and no security partner.
- The other has both.
Same attack, same attacker, with wildly different outcomes. By the end, you'll know exactly what happens during those critical first 24 hours, and which scenario you're likely to experience based on your current security situation.
Scenario A: The Business Without an Incident Response Plan
Hour 0–1: The Ransomware Attack Is Discovered
The countdown timer on the screen says 72 hours to pay, or the price doubles. Nobody in the office has seen anything like this before. Questions start racing: What do I do? Should I unplug the computer? Do I shut it down completely? Do I call the police? Is this just my computer, or is it everywhere?
Nobody has clear answers, because nobody has a plan that says who checks what, in what order, or who to call first.
Hour 1–4: No Incident Response Plan Means No One Knows Who to Call
Desperate calls start going out—to the IT person who handles the website, to the “experts” at a local electronics big box store, and to anyone else who might know what to do. Without a dedicated incident response contact hours are lost simply figuring out who should even be handling this.
Hour 4–12: Do You Have Working Backups? (And Should You Pay the Ransom?)
Someone finally asks the question that matters most: "Do we have backups?" Unfortunately, even though the answer is “Yes”, they were stored on the compromised network and were deliberately encrypted by the attacker.
With no working backup, the conversation shifts to whether to pay the ransom. Tension is high regarding this decision as there's no assurance the attacker will actually hand over usable decryption keys, or that they won’t leak or sell the stolen data regardless of payment. A paralysis sets in.
Hour 12–24: Downtime, Angry Customers, and Climbing Costs
Business has effectively stopped. Employees can't access files, create invoices, or even properly communicate. Customers start noticing…and calling. That means having embarrassing conversations about what has happened. Between the ransom, lost business, and professional recovery help, the costs are climbing exponentially along with anxiety and panic.
By the 24-hour mark, this business hasn't come close to resolving the incident—it's just starting to understand the scope of it.
Scenario B: The Business With an Incident Response Plan
Hour 0-1: The Same Alert Appears — But the Response Is Already in Motion
The same red alert. The same countdown timer. The same panicked expression on the face of the team member breaking the news. But something is very different—there’s a plan in place.
A hard copy of the incident response plan is pulled from the files. Two calls are placed: one to the IT partner who helped create this plan, and the other to the cyber insurer.
There's no scramble to figure out who's in charge. That question was answered months ago.
Hour 1-4: One Call Puts a Trained Response Team on the Case
Within minutes, the IT partner’s incident response team is remotely assessing the situation — isolating the affected device, checking how far the infection has spread, what was touched, and whether it's contained to one device or already moving. Because monitoring tools have been watching the network all along, they're not starting from zero; in many cases, unusual activity was flagged and investigated before anyone at the office even noticed a problem.
Employees are told what's happening and what to do (and not do) in plain language. No panic, no guesswork, no calls to the electronics store.
Hour 4-12: Backups Are Verified — And They Actually Work
The question "do we have backups?" doesn’t need to be asked. Secure, tested backups are stored offline and separately from the main network, exactly so an attacker can't reach and encrypt them along with everything else. They're accessed, scanned to confirm they're clean, and verified before anything gets restored.
There's no ransom conversation to have. No paying a stranger and hoping they keep their word.
Hour 12-24: Back to Business, With a Clear Picture of What Happened
By this point, most systems are already back online. Employees are working, invoices are going out, and customers likely never noticed anything was wrong. The response team is finishing up a clear report: how the attacker got in, what was affected, and what changes—if any—should be made to close the gap for next time.
By the 24-hour mark, this business isn't still trying to understand what happened. It already knows, it's already recovering and returning to normal operations.
What Actually Happens During Ransomware Incident Response
With Scenario B containment and recovery took place quickly and calmly. But what's actually happening behind the scenes during those first 24 hours? Let’s explore the basic process a security partner follows, in plain terms.
Step 1: Contain the Threat
Top priority is stopping the attack from spreading any further. This may mean disconnecting affected devices from the network, but importantly, not shutting them down. Powering off a device can erase information responders need to understand how the attacker got in, which is critical for making sure they can't just walk back in the same way.
Step 2: Assess the Damage
Before anything gets fixed, responders need to know what they're dealing with: which devices and systems are affected, what data may have been accessed or stolen, and how the attacker got in in the first place (most commonly through a phishing email or a software vulnerability that hadn't been patched). This step determines everything that follows.
Step 3: Remove the Threat
Once the scope is understood, the attacker's access is shut down for good. Malicious software is removed, their entry point is closed, and credentials are reset. Skipping this step is how businesses end up hit twice by the same attacker.
Step 4: Restore Systems and Data
With the threat removed, clean backups are verified and used to bring systems back online. This demonstrates why backups need to be stored separately from the main network—if they're reachable during an attack, they can be encrypted right along with everything else, leaving nothing to restore from.
Step 5: Report, Notify, and Learn
Depending on what data was involved, there may be legal obligations to notify affected customers, employees, or regulators. A good incident response process also includes a debrief: how the attacker got in, and what needs to change so it doesn't happen again.
Why Business Continuity Comes Down to Preparation
The core difference between Scenario A and Scenario B isn’t due to happenstance or the attacker’s skill. It’s preparation:
- having an incident response plan
- having a partner who’s already integrated into your environment before anything goes wrong.
Think of it like a fire drill: no one expects the alarm to go off at 2 PM on a Tuesday, but when it does, everyone knows exactly where to go and what to do because they’ve practiced. Incident response works the same way. When a plan exists, roles are clear, tools are already in place, communication channels are open, and the critical first hours aren’t lost to confusion or missteps.
For small and mid-sized businesses, that preparation often comes from working with a managed security partner. Beyond basic IT support, it’s a skilled team that:
- Creates a tailored incident response plan for your business
- Runs continuous threat detection and regular security audits
- Acts fast to contain the breach and keep operations running with emergency cyber response when something hits
- Provides full recovery support including data restoration, system repairs, improved protocols, and post-incident analysis to prevent recurrence
The benefit is not hypothetical. It’s the difference between an incident that becomes a threat to the survival of your business, and one that’s contained and resolved, leaving the business stronger for the lessons learned from it.
Which Scenario Are You In?
In our simplified attack scenario, you've seen both paths play out:
-
One business lost its data, its revenue, and its customers' trust because there was no plan, no partner, and no clear path forward when the alert appeared.
-
The other contained the threat quickly, restored from clean backups, and returned to operational status because they had done the work before the attack ever happened.
The difference wasn't technology. It was preparation.
Which of the two examples most closely represents your current level of readiness? If you're thinking Scenario A—panic and unanswered questions—that's a signal to take immediate steps toward preparedness. A risk assessment will quickly give you the insights you need to move into the territory of Scenario B—prepared, defended, and supported.
Ready to protect your business from ransomware?
allCare IT builds tailored incident response plans for businesses across Kingston, Ottawa, Belleville, and Eastern Ontario — including 24/7 threat detection, emergency response, and full recovery support. The first step is a free discovery call to understand where you are now and what closing the gap actually looks like for your business.