Who to call
You don't have to face this alone, and you don't need a lawyer to start. Save these numbers now.
Why this annex
In October 2026, hackers broke into 4 of Canada's largest law firms by phoning staff and pretending to be IT support. A source told The Globe and Mail that 31,000 files were taken from one firm alone.
Law firms, clinics, employers and agencies hold the most private chapters of our lives: harassment complaints, firings, custody and divorce files, medical and addiction records, criminal charges, settlements and wills. Many of the people named in those files were never the organization's client.
People with money and lawyers have a team when their secrets leak. Most of us don't. This annex is for everyone else: the mother whose custody file was in a lawyer's cabinet, the employee who filed a complaint, the teenager whose photo is being used against her.
A message arrives from a stranger. It quotes a line from a complaint you filed at work 3 years ago and says the rest goes to your family unless you pay. Your stomach drops. If you've read this page, you know what to do in the next 10 minutes: don't answer, don't pay, take screenshots, and call the Anti-Fraud Centre and the police. You're not alone, and you're not the one who did something wrong.
Prevent
Prevention means stopping it before it starts. Most break-ins like this one start with a friendly voice and a reasonable-sounding request. Tick what you've done. Your ticks stay on this device only.
Mitigate
Mitigation means making it less harmful if it happens anyway. The less there is to find, and the less a thief can do with it, the smaller the damage.
Prepare
Preparedness means knowing what you'll do before you need to. A leak feels like an emergency because it comes with shame and a clock. A little preparation takes the power out of both.
Respond
Response means what you do in the first hours. Extortion runs on panic and speed. Slow it down.
Do this
- Stop replying. Don't argue, bargain or explain.
- Take screenshots of every message, the sender's name or number, and the date.
- Report it to police and to the Canadian Anti-Fraud Centre.
- Change your passwords, starting with email, and turn on two-step login.
- Tell your one safe person. You don't have to carry this alone tonight.
Don't do this
- Don't pay. Paying rarely ends it and often brings a second demand.
- Don't delete the messages. They're evidence.
- Don't pay anyone online who promises to "remove" your images for a fee. That's often a second scam.
- Don't blame yourself. Sharing someone's intimate images without consent is a crime in Canada. The crime is theirs.
Stop. Save. Report. Tell someone safe.
Recover
Recovery means getting your life and your peace back. It takes time, and there's real help.
Keep life running
Emergency planners call this business continuity. Here it means keeping your job, your money and your household steady while the storm passes.