Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
KEY TAKEAWAYS
- Disconnect first. A machine that’s still online keeps draining accounts and pushing scams at your contacts.
- Reset passwords from a clean phone or laptop, not the infected one. Email is the priority because it unlocks everything else.
- Turn on multi-factor authentication on every account that supports it before you do anything else.
- Report to the Canadian Anti-Fraud Centre, RCMP NC3, your bank, and the OPC if personal data was exposed.
- Run a complete malware scan, then write down times, screenshots, and case numbers as you go.
Have you been hacked? Start here.
If you suspect an account or device has been compromised, the next ninety minutes matter more than the next ninety days. Stop using the affected machine, switch to a second one you trust, and work the six steps below in order. Across Fusion Computing’s 47 incidents we helped individuals respond to in 2024-2026, this sequence works whether the trigger was hacked Gmail, a fake CRA text, an e-Transfer scam, or a ransomware pop-up.
Talk to a Canadian security expert
Six-step response at a glance
| Step | Action | Why it matters |
|---|---|---|
| 1 | Disconnect compromised devices and accounts | Stops active data theft and remote control sessions |
| 2 | Change passwords from a clean device | Prevents the attacker from capturing the new credentials |
| 3 | Enable MFA on every account | Blocks reuse of stolen passwords from breach dumps |
| 4 | Report to CAFC, RCMP NC3, and the OPC | Creates a case record banks and platforms accept |
| 5 | Contact your bank if financial data was exposed | Triggers fraud holds, card replacement, dispute filings |
| 6 | Run a malware scan and re-secure devices | Removes persistence so the attacker cannot return |
Step 1: Disconnect compromised devices and accounts
According to Statistics Canada’s Canadian Internet Use Survey, 70% of Canadian internet users experienced a cyber security incident in 2022, up from 58% in 2020. Getting offline quickly is the one move that stops every category of active attack at once, from data theft to live screen control. Source: Statistics Canada, 2023.
Pull the affected machine off the internet first. Turn on airplane mode, disable Wi-Fi, or unplug the ethernet cable. If a remote-access tool like TeamViewer or AnyDesk is running because a fake support agent had you install it, end the session and uninstall the tool. Disconnection cuts the attacker’s live access while you work the rest of the steps.
Sign out of suspicious sessions on the account side too. Most providers (Google, Apple, Meta, and most others) expose a “sign out everywhere” or active-session list. Use it.
Step 2: Change passwords from a clean device
Fusion Computing sees the same mistake across its individual incident calls: a credential reset typed on a still-infected laptop hands the attacker the new secret in real time. Start from clean hardware, then work through accounts in priority order. The Government of Canada’s Get Cyber Safe program publishes plain-language account-security steps for individuals. Source: Get Cyber Safe, Government of Canada, 2026.
Move to a phone or computer you trust, ideally one that has never signed in to the account in question. Reset the email login first, whether that’s Gmail, Outlook, or iCloud, then banking, then social, then anything sharing the same credentials. Use a password manager to generate unique replacements; reuse turns one breach into total takeover.
After you regain access, check for forwarding rules, changes to recovery contact details, and unfamiliar app permissions. Attackers plant these so they can walk back in later; most major providers surface them in their account security checkups.
Step 3: Enable MFA on every account
Multi-factor authentication blocks 99.2% of automated account-takeover attempts according to Microsoft’s security research (2023). Turn it on for your inbox, banking, social, and cloud storage. App-based codes (Google Authenticator, 1Password, Authy, or similar) are stronger than SMS, though SMS still beats no MFA at all. Our explainer on the benefits of multi-factor authentication walks through the trade-offs without jargon.
Step 4: Report the incident
Reporting in Canada is free and creates the paper trail banks, insurers, and platforms ask for. According to the Canadian Anti-Fraud Centre (2025), Canadians reported more than CA$638 million in losses in 2024, and fewer than 10% of victims ever file a report. Use more than one authority; each handles a different slice. Source: CAFC, 2025.
| Authority | What to report | How |
|---|---|---|
| Canadian Anti-Fraud Centre (CAFC) | Fraud, identity theft, money loss, romance scams | antifraudcentre-centreantifraude.ca or 1-888-495-8501 |
| RCMP National Cybercrime Coordination Unit (NC3) | Cybercrime, ransomware, extortion, online threats | reportcyberandfraud.canada.ca |
| Office of the Privacy Commissioner (OPC) | Personal data exposed by an organization | priv.gc.ca/report-a-concern |
| Canadian Centre for Cyber Security | Critical infrastructure or business-scale incidents | cyber.gc.ca or 1-833-CYBER-88 |
| Local police (non-emergency) | Threats, blackmail, stalking, sextortion | City police non-emergency line; 911 if active |
Step 5: Contact your bank if financial data was exposed
If a card number, banking login, Interac e-Transfer, or void cheque was shared, call the 24/7 number on the back of your card right now. Speak to a person rather than emailing, and do not wait until morning. The first 60 minutes often decide whether unauthorized charges can be reversed before settlement.
Ask the agent to freeze it, flag the account for monitoring, and document a case number. Then place a fraud alert with both Equifax Canada (1-800-465-7166) and TransUnion Canada (1-800-663-9980); one bureau does not notify the other.
Step 6: Run a malware scan and re-secure devices
On Windows, run a full Microsoft Defender scan plus a second-opinion tool like Malwarebytes Free. On macOS, the built-in XProtect plus Malwarebytes for Mac is a reasonable pair. On iPhone or Android, update the OS, remove apps you don’t recognize, and review configuration profiles or admin permissions an attacker may have planted.
If pop-ups keep returning, the screen is locked by ransomware, or you gave remote access to a fake support agent, treat it as untrusted until a professional clears it. A local repair shop or Canada Computers can do a deep clean. For business machines, talk to a Canadian security expert instead.
Many of the individuals who call us also run a company; the same Fusion Computing team covers both sides:
“We chose Fusion after evaluating several MSPs and have been extremely pleased. They have been a key partner in helping us strengthen our cybersecurity while keeping the business running smoothly.”
How do you know if you have actually been hacked?
Real compromises usually leave fingerprints. The Canadian Centre for Cyber Security publishes advisories on the brands scammers impersonate most, including the CRA, Canada Post, and major banks. If two or more of the signals below appear at once, treat the situation as a confirmed incident and run the six steps above.
- Account-recovery emails arrive that you never asked for
- Friends or coworkers report messages or DMs you never sent
- Unknown sign-ins, devices, or locations show in your account activity
- Email forwarding rules, backup phone numbers, or backup emails changed without your input
- Bank, card, or e-Transfer alerts for transactions you don’t recognize
- The browser homepage or default search engine changed by itself
- Antivirus or Defender is suddenly disabled and won’t turn back on
- Pop-ups demand a ransom or push a fake support number at you
- Your mobile bill shows premium SMS charges or unfamiliar international calls
- Two-factor codes arrive when you weren’t signing in
Across our 47 individual incident calls from 2024 to 2026, we tracked which signal showed up first. “2FA codes I didn’t request” won, and an FC internal benchmark from Q2 2026 built on that anonymized client data put it ahead of every other symptom on the list. Unrequested codes mean the attacker already has your password and MFA is the only thing still holding the door.
Not sure what you’re seeing? Talk to a Canadian security expert before you wipe anything; wiping destroys the evidence claims adjusters and investigators ask for.
What does “your password was found in a data breach” mean, and what does it require?
According to Google’s Chrome password protection documentation, the browser warns you when a username and password you saved were involved in a data breach at some site you used. The alert is a match against a leaked list. It is not evidence that anyone signed in to your Google account. Source: Chrome Help, 2026.
The fix follows from that. A breach alert burns the password everywhere you reused it, so change it on every site that shares it, starting with email and anything that touches your bank. The catch is that Chrome only flags the copies it saved, so reused ones it never saw stay live until you go and find them.
Canada’s ITSAP.30.032 password guidance is blunt about it: do not use passwords found in known data breaches. In our practice, the callers who get burned twice are the ones who changed the flagged password and stopped there, leaving years of reuse untouched behind it.
Two moves close it out. Turn on MFA for the affected account so a stolen password alone stops working, then check Have I Been Pwned, which indexes roughly 17.7 billion exposed addresses, for the other breaches yours appears in.
Hacked or scammed? The difference changes the checklist you follow
According to the Canadian Anti-Fraud Centre, frauds are catalogued by how the victim was reached and whether individuals or businesses were targeted. That split decides your first move. A hack is unauthorized access to an account or device. A scam is you being persuaded to pay someone or grant them access. Source: CAFC, 2026.
If you were hacked, containment comes first. Work steps 1 through 3 above: disconnect, reset credentials from clean hardware, and revoke active sessions before the attacker notices you are moving. Recovering what was taken, where that applies, comes after the door is shut.
If you were scammed, the clock is financial. Start with the number on the back of your card, ask for a fraud hold and a case number, then file with the CAFC at 1-888-495-8501. An Interac e-Transfer that has not been deposited can sometimes still be cancelled in your banking app.
Fake support calls combine the two. The caller talks you into installing remote-access software, which is the scam, then uses it to take the machine, which is the hack. Of the 47 individual incidents we handled from 2024 to 2026, that combination did the most damage, costing the caller a device and a bank balance in a single sitting.
How do you prevent this from happening again?
According to the RCMP’s National Cybercrime Coordination Unit, most cybercrime in Canada is preventable with basic credential hygiene, MFA, and software updates. Fusion Computing recommends the same four habits to every individual we help; set them up once and the next phishing message doesn’t land. Source: reportcyberandfraud.canada.ca, 2026.
- Use a password manager. Bitwarden, Dashlane, and similar tools generate a unique login per site and warn you about reused or breached ones.
- Turn MFA on everywhere. Email, banking, social, and cloud storage at minimum. App-based codes beat SMS.
- Enable automatic updates. Operating system, browser, and apps. Most successful attacks exploit holes a patch already fixed.
- Build a verification rule for anyone demanding funds. If a text, voicemail, or urgent request brings payment pressure or “don’t tell anyone,” verify through a known number first.
If you also run a business, the same four habits have to hold across every staff account, not just yours. Ask our CISSP-led team for a company-wide review and we’ll tell you which one is weakest.
Fusion Computing runs a CISSP-led security team at a Microsoft Solutions Partner, working since 2012 with Canadian businesses and the individuals behind them.
Talk to a Canadian security expert
Frequently asked questions
What should I do first if my email was hacked?
Move to a trusted second device and open the provider’s official recovery page. Google, Apple and Facebook all publish one. Reset the sign-in, turn on MFA, then check for forwarding rules and edited backup contact details the attacker may have planted.
Where do I report cybercrime or fraud in Canada?
Use the RCMP NC3 portal at reportcyberandfraud.canada.ca and the Canadian Anti-Fraud Centre at 1-888-495-8501. If a company exposed your personal data, also report to the Office of the Privacy Commissioner. Add local police if you lost money to theft or threats were involved.
How do I know if my computer is actually infected?
Look for two or more signals together: pop-ups demanding payment, a homepage that changed by itself, antivirus disabled, login codes arriving when you weren’t signing in, or messages you never sent. Run a full Microsoft Defender scan plus Malwarebytes for a second opinion.
Do I need to contact both Equifax and TransUnion?
Yes. The bureaus don’t share alerts. Call Equifax (1-800-465-7166) and TransUnion (1-800-663-9980) separately. Ask each for a fraud alert, a consumer statement with your phone number, and instructions for reviewing your credit report.
What if I sent money by Interac e-Transfer to a scammer?
Try to cancel the transfer in your banking app if it hasn’t been deposited. If the recipient uses Autodeposit, it landed instantly; still call your bank’s 24/7 line, file with the CAFC, and request a case number. Banks sometimes recover funds when reported quickly.
Should I pay a ransomware demand?
The RCMP and Canadian Centre for Cyber Security both advise against paying. Payment funds the next attack, doesn’t guarantee file recovery, and may expose you to sanctions. Disconnect the device, preserve evidence, report to NC3, and consult a professional. For businesses, our cybersecurity services team handles ransomware triage.
Is multi-factor authentication really worth the friction?
Yes. Microsoft reports MFA blocks 99.2% of automated account-takeover attempts. Thirty seconds of friction prevents the days or weeks of cleanup after a compromise. App-based codes beat SMS, but any MFA beats none.
How do I help an older parent who has been scammed?
Keep shame out of it. Call the bank first if money is involved. Lock down email and phone-account recovery settings. Set up a password manager like 1Password or Bitwarden and MFA together. Write key phone numbers on paper so they can find them during the next scare.
