Ransomware – Canadian Centre for Cyber Security
Summary
Ransomware is a type of malware that denies users access to systems or data until a ransom is paid. The Cyber Centre warns it is the most common and growing cyber threat facing Canadians. Attacks typically involve encrypting, stealing or deleting data and often include threats to publish stolen data (double extortion).
The page summarises impacts — from operational downtime and permanent data loss to intellectual property theft, privacy breaches, reputational damage and high recovery costs — and stresses that basic cyber security practices would prevent the vast majority of incidents. It includes a Conti group case study detailing a typical four‑stage attack cycle (reconnaissance, intrusion, infection, impact), some facts and figures on Conti activity and ransom averages, and a wide range of practical guidance and resources for organisations and the public.
Author style
Punchy: This is an important, no‑nonsense briefing. If you look after IT, risk, or operations, the detail matters — the guidance tells you what to lock down and where to start.
Key Points
- Ransomware denies access to systems or data until a ransom is paid and remains the top cyber threat in Canada.
- Consequences include downtime, permanent data loss, IP theft, privacy breaches, reputational harm and high recovery costs.
- Most ransomware incidents can be prevented by following basic cyber security practices and controls.
- The Conti case study outlines four stages: reconnaissance (target selection), intrusion (stolen credentials or spear phishing), infection (malware, C2 tools, lateral movement) and impact (encryption, data exfiltration, double extortion).
- Conti has leaked hundreds of gigabytes from 450+ attacks and claimed at least 24 Canadian victims in 2021; average ransom around USD 373,902 as of Sept 2021.
- Cyber Centre provides extensive guidance for organisations and individuals: playbooks, prevention and recovery guides, phishing awareness, backup tips, MFA recommendations and incident reporting.
Why should I read this?
Look — if you care about keeping your organisation running and your data private, skim this now. It cuts through the hype, shows how a real gang (Conti) operates, and points to practical controls and free resources you can act on straight away. It’s short, useful and likely to save you time and money later.
Context and relevance
This guidance is highly relevant to IT teams, business leaders and small‑to‑medium organisations because ransomware attacks are increasing and increasingly targeted at critical services. The Conti example highlights common attack vectors (spear phishing, stolen credentials, unpatched systems, misuse of admin tools) which map directly to standard mitigations: strong backups, patching, multi‑factor authentication, user training, least privilege and an incident response plan. The page also links to public awareness campaigns like Get Cyber Safe and explains how to report incidents to the Cyber Centre.
