Four Hundred Paycheques Never Arrived on Friday

WRENFIELD, Ont. — November 13, 2026 — Four hundred and twelve people woke up on Friday expecting to be paid. None of them were. The money was in their employers’ accounts. The hours had been logged, the deductions calculated, the deposits scheduled. But the company that moves the money from one account to the other had gone dark overnight, and by the time anyone understood why, payday was already over.

Lakeshore Payroll Services is a fictional payroll firm in Wrenfield, a fictional Ontario town of about 14,000 people, that handles pay for roughly forty small businesses across the region — bakeries, diners, a hardware store, a landscaping crew, a daycare, and a dozen more. On Thursday evening, the firm’s computers locked up. The files that hold every client’s pay runs, tax deductions, and bank details were encrypted behind a ransom demand, and the staff could not open a single one.

More than four hundred workers went unpaid on a Friday — because the company that runs their payroll was locked out of its own files.

The firm says the trouble started with an email to its bookkeeping desk on Wednesday afternoon. It looked like a routine message from a fictional benefits provider, asking a bookkeeper to open an attached form. She did. The ransomware inside it spread through the office network in under an hour, and by Thursday morning the payroll system itself was locked. The firm says it did not pay the ransom, and no client data has been published. But the pay runs for Friday were inside the locked files, and there was no way to get them out in time.

“We had the money. We had the hours. We had everything except the file that puts the two together,” said Colin Barrett, the fictional firm’s owner. “I spent Friday morning on the phone with forty business owners, telling them their people would not be paid today, and I had no date I could give them. These are not big companies. Their staff live paycheque to paycheque. A missed Friday is a missed rent payment, a missed grocery run, a missed car payment — and it happened to all of them at once.”

Marta Kowalski, who runs a fictional bakery in Wrenfield, was one of the forty. She says she spent Friday afternoon writing paper cheques by hand for her nine staff, working from the hours she keeps in a notebook, while her own rent came due the same day. “I have run this bakery for eleven years and I have never missed a payday,” she said. “On Friday I was standing at my own counter, adding up hours on a calculator, because the company I pay to do this for me could not open its own computer. My staff were kind about it. They should not have had to be.”

The firm did not lose the money. It lost the list of who gets paid, and how much — and without that list, payday did not happen.

Payroll is the kind of service small businesses never think about until it stops. A bakery, a diner, or a daycare does not keep a payroll department; it pays a firm to handle the arithmetic, the deductions, and the deposits, and it trusts that the firm has its own backups and protections. When that firm goes down, the failure lands on forty employers at once — and on every one of their workers, at the same hour, on the same day.

“People picture a cyberattack on a business as a stolen credit card or a hacked website,” said Dr. Alan Reyes, a fictional small-business finance researcher who studies how small firms recover from attacks on their suppliers. “But the attacks that hurt ordinary people most are the ones that stop a service they never see. A payroll firm is a single point of failure for dozens of small employers. Lock its files on a Thursday night and four hundred people wake up unpaid on Friday — and none of them did anything wrong.”

In this fictional case, the firm says it rebuilt its payroll system from backups over the weekend and the missed pay runs went out on Monday, three days late. It says the bookkeeper’s email account has been rebuilt with a second login check, and the payroll files are now kept on a separate system from office email. It has not said how many workers were still waiting for their money by Monday, or whether any of the forty businesses have moved their payroll elsewhere.

The fictional businesses say they have since changed how they treat payday. Each one now keeps its own copy of staff hours and pay rates, updated every week, so a payroll failure does not leave them guessing. Several have agreed on a shared emergency plan: if the deposits do not land by Friday morning, the owners write paper cheques the same day, from their own records, instead of waiting for the firm to recover.

The defence is not a sharper eye for suspicious emails. It is never letting one locked file decide whether four hundred people get paid.

That advice applies well beyond one payroll firm. Across Canada, small businesses hand their most time-critical work — payroll, invoicing, scheduling — to a single outside provider, and rarely ask what happens if that provider goes down on the wrong day. A missed payday is not a data breach. It is a week of rent, groceries, and bills arriving on time while the money does not.

Lessons Learnt

• Ask your payroll provider how they would pay your people if their system went down. A good provider has a tested backup and a plain answer. If they cannot explain it, that is your answer.
• Keep your own copy of hours and pay rates, updated weekly. If the payroll firm cannot open its files, your own records let you pay people by cheque the same day instead of waiting.
• Hold a cash buffer for one payroll cycle. A missed payday becomes a crisis when there is nothing to bridge it. One cycle’s worth of payroll in reserve buys your staff time.
• Put payday in your incident plan. Decide now who writes the cheques, who tells the staff, and what you say to them. The first time you make that decision should not be on a Friday morning.

The fictional firm says the missed pay runs have now gone out, and the workers from Wrenfield’s small businesses have been paid. The money arrived three days late. The Friday it was supposed to arrive on is the part nobody gets back.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.