When an entire town takes back control
One Friday night, a ransomware attack paralyzed the administration of a Quebec municipality: encrypted workstations, citizen services down, a ransom demand. We activated a crisis team, contained the attack, restored systems without paying a cent — then built a plan so it would never happen again.
- Client
- Confidential
- Industry
- Public sector · Municipality
- Region
- Capitale-Nationale, Quebec
- Context
- ≈ 12,000 citizens, 40 employees
- Services
- Incident response · Restoration · Continuity plan
- Duration
- 5 days of response + 3 months of resilience
One Friday night, everything stops
Like many small municipalities, this one ran with a lean IT team and limited resources. No one imagined being a target — until an employee clicked on a booby-trapped attachment. Within hours, most of the administration was down.
- Workstations and servers encrypted, with a ransom demand.
- Citizen services paralyzed: taxes, permits, email.
- Backups partially hit and never tested.
- No response plan or crisis communication.
Anatomy of a controlled recovery
In a crisis, every hour counts. Here is how we took back control, step by step, without panic or giving in to blackmail.
- H+0Detection & alert
Employees report inaccessible files. Our crisis team is activated in under an hour.
- H+2Containment
Network isolation, disconnection of infected machines and evidence preservation.
- H+8Scope assessment
Mapping the attack and identifying clean, offline backups.
- D+2Restoration
Rebuilding critical servers from verified backups — without paying the ransom.
- D+5Service resumption
Essential citizen services back online and transparent official communication.
So it never happens again
Restoring is not enough: the town had to become lastingly harder to attack. We put six pillars of cyber-resilience in place.
Offline, encrypted backups tested every month.
MFA on all remote access and administrator accounts.
Anti-phishing training and simulations for all 38 employees.
Crisis procedures, roles and a documented communication plan.
Continuous threat detection and alerts, 24/7.
Restoration exercises run twice a year.
A town standing — and better prepared
Beyond returning to normal, the municipality now has a security posture it can stand behind in front of its citizens.
Overnight, we lost access to everything. Codally took charge calmly and methodically: within days our services were back, without paying the hackers a cent. Today, we are prepared.
Are you ready if everything stops tomorrow?
A plan before the crisis beats one after it. Let’s talk cyber-resilience.