Working with police after a cyber incident in Canada
In Canada, a business hit by ransomware, extortion or fraud reports it to its local police and to the national reporting system run by the RCMP’s National Cybercrime Coordination Centre (NC3) and the Canadian Anti-Fraud Centre. If anyone’s safety is threatened, call police at once. Otherwise, do it after the first containment decisions, with counsel involved. Expect a file number and intelligence sharing, not a recovery team.
Who to report a cyber incident to in Canada
Report to your local police service, whether that is a municipal force, a provincial force or the RCMP under contract, and file the same report with the National Cybercrime and Fraud Reporting System, which the RCMP’s National Cybercrime Coordination Centre runs with the Canadian Anti-Fraud Centre. The national system is at reportcyberandfraud.canada.ca. Its main job is collecting reports so police can connect them; the investigating is done by the police service that takes your file.
Two other bodies are often confused with the police. The Canadian Centre for Cyber Security takes incident reports and gives technical guidance, but it is not a law enforcement agency. And a police report is not a breach report to a privacy commissioner or a sector regulator. Whether one of those is needed is a separate decision for your counsel.
When to call the police
If anyone’s physical safety is threatened, including an extortion message that threatens staff or names where they live, call 911 or your local police at once and do not wait for counsel. Otherwise, report once the first containment decisions are made and counsel is involved, rather than in the first chaotic hour. If money has been sent to a fraudster, call your bank first: a recall request is time-sensitive and the police cannot reverse a payment.
Typical triggers are a ransom or extortion demand, a payment diverted by business email compromise, theft of data by an insider, and threats against staff. Threats against staff are the exception to the timing above: that call is made straight away. Some insurers also ask for a police file number with the claim. Where nobody is in danger, do not let the report hold up containment. The police call can wait an hour; isolating an encrypting server cannot.
What police will and will not do
Police record the report, give you a file number, link it to other reports and may investigate if there are leads. They do not restore systems, remove an intruder, recover data or decide whether you must notify anyone.
Be realistic about the rest. Many attackers operate from outside Canada, so investigations are slow and arrests are uncommon. Updates may be infrequent. Reporting is still worth it. Your indicators can link your case to others, and the file number is something your bank, insurer or board may ask for.
Police may ask for logs, email headers or disk images. Agree with counsel what you will provide before the request arrives.
Does giving evidence to police affect privilege
It can. Material handed to police may later be disclosed in a prosecution, and sharing a privileged forensic report can put the privilege at risk. Counsel should decide what goes to police, and in what form, before anything is sent.
A common approach is to give police the facts and indicators (IP addresses, wallet addresses, the ransom note, attacker messages, a timeline) rather than the investigation report itself. How evidence was collected matters too: handling has to stand up if the matter reaches court, a regulator or an insurer. See preserving evidence after a breach. We are not lawyers; we work alongside your counsel, and forensic work is delivered with appropriately licensed partners where the law requires it.
What to have ready before you call the police
- A timeline of what was observed and done, with times.
- One named contact for police, and counsel’s details.
- Indicators: IP addresses, domains, email headers, file names.
- For fraud: bank, amounts, transaction references and the recipient account.
- For extortion: the ransom note, every attacker message and any wallet address, unedited.
- Your insurer’s claim number, if a claim is open.
The first 24 hours of an incident covers the steps that come before this call, and incident response and forensics sets out how we support the response.
How the work is bounded
The scope is agreed in writing before work starts, and the engagement is quoted in writing with it.
Investigation and forensic work is delivered with appropriately licensed partners where the law requires it.
SecHB does not issue certifications, attestations or audit opinions: those come from accredited certification bodies, CPA firms and QSAs. The work here is what an organization does to be ready for them.
Nothing here is legal advice. Where a question turns on the law, the work is done alongside the client’s counsel, not instead of them.
Questions we are asked
Who do we report a cyber incident to in Canada?
Report to your local police service, whether that is a municipal force, a provincial force or the RCMP under contract, and file the same report with the National Cybercrime and Fraud Reporting System, which the RCMP’s National Cybercrime Coordination Centre runs with the Canadian Anti-Fraud Centre.
When should we call the police?
If anyone’s physical safety is threatened, including an extortion message that threatens staff or names where they live, call 911 or your local police at once and do not wait for counsel. Otherwise, report once the first containment decisions are made and counsel is involved, rather than in the first chaotic hour. If money has been sent to a fraudster, call your bank first: a recall request is time-sensitive and the police cannot reverse a payment.
What will the police actually do?
Police record the report, give you a file number, link it to other reports and may investigate if there are leads. They do not restore systems, remove an intruder, recover data or decide whether you must notify anyone.
Can giving evidence to police affect legal privilege?
It can. Material handed to police may later be disclosed in a prosecution, and sharing a privileged forensic report can put the privilege at risk. Counsel should decide what goes to police, and in what form, before anything is sent.
Planning the police step before you need it
Tell us how your incident plan handles law enforcement today. We will help write the police step into it and rehearse it in a tabletop exercise. More of our writing is indexed at writing.