A regional accounting and advisory firm with 3 offices across southern Alberta discovered on a Thursday morning that its central file management system had become inaccessible. The firm employed 47 staff members across its locations and served approximately 1,200 active clients, ranging from individual tax filers to mid-sized manufacturing operations and several non-profit organizations. The system outage initially appeared to be a routine technical failure, but within 4 hours the firm's IT contractor confirmed that the disruption stemmed from a ransomware attack that had encrypted client files, internal communications archives, and the firm's scheduling and billing platforms.
The timing could not have been worse. The disruption occurred 6 weeks before the personal tax filing deadline, during the busiest period of the firm's annual cycle. Client documents submitted electronically over the preceding 3 months remained locked within the compromised system. Staff members at all 3 locations found themselves unable to access work files, communicate through internal channels, or confirm upcoming appointments with clients. The firm's managing partner and operations director faced immediate decisions about what to tell employees who were arriving at their desks to find their workstations frozen, what to communicate to clients who had entrusted sensitive financial documents to the firm, and whether regulatory notification was required given the nature of the data potentially affected.
The firm maintained a general business continuity plan that addressed premises emergencies and key personnel loss, but the plan had not been updated in 2 years and contained only a brief paragraph on communications during a disruption. No media relations protocol existed. The firm had a modest social media presence — a business page with approximately 800 followers and an occasional professional networking account — but no designated spokesperson and no experience managing public attention during an adverse event. Within 24 hours of the initial discovery, a local business reporter contacted the firm's reception line seeking comment on rumours of a cyberattack affecting a professional services provider in the region.
The firm's leadership now confronted overlapping communication challenges: keeping staff informed and functional across multiple locations, notifying clients whose data might be affected, determining what obligations existed toward professional regulators and privacy authorities, managing supplier relationships while payment systems remained offline, and responding to media inquiries without making statements that could create legal exposure or inflame public concern. The decisions made over the following 72 hours would shape whether the disruption remained a difficult but survivable incident or escalated into a reputational and operational crisis that threatened the firm's long-term viability.