After discovering the ransom note, most people feel the need to "fix" things. However, this is almost always the worst possible thing to do. Disconnect the infected computers from the network (pull the Ethernet cable or turn off their Wi-Fi) as soon as possible, but keep the computers turned on if at all possible. This is because sometimes the keys or some details about processes are still in volatile memory, and they are gone once the power is. Take pictures of the note. Keep a copy of an encrypted file and try to find an unencrypted original of the same file. A matched pair like that will often identify the family of malware and tell you if a publicly available decryption tool has been released for it.
Then halt all automatic backups before anything else. That is the most costly mistake that we find ourselves looking at, and no one is to blame for it: the nightly automated backup ran as planned and faithfully replaced all the previous good copies with encrypted versions. All snapshot, replication, cloud syncing and other options behave the same way (since none of these tools can tell whether a change is legitimate or malicious). Stop them first, then work out what you really do still have.
First place: anything that didn't get hit by the attack. Offline media is probably your best bet for this: a rotated drive in a safe, an archive tape, the disk someone unplugged back in March and forgot about. If it wasn't connected at the time then it is probably still okay, which is why you want to keep one copy that has no permanent connection to anything. Cloud sync services will also often save versions, but they have limited retention periods, so check that first before you assume.
Second place: the deleted originals. Plenty of ransomware encrypts a copy of every file and then deletes the original instead of overwriting it. Deleting means the pointers to those files are removed but the content stays on the hard drive until some other program needs the space. A forensic pass across the raw disk can restore a substantial proportion of your pre-attack files intact. It's routine recovery work, as opposed to cryptography, and this is where we get most of our good news.
Third place: what the attacker missed. It's hard to encrypt an entire estate quickly enough before something happens (such as it being noticed), or without making some sort of noise. So many attacks don't get to complete their task, because someone notices, a device has gone into standby, or the process falls over on a very big share. Partial encryption is extremely common: file headers are encrypted while the rest of the file still reads properly, whole directories get skipped, and sometimes a single server is left alone since it wasn't on that particular evening. An analysis of what is actually encrypted versus what merely looks encrypted is the first useful thing anyone can give you.
We will not help you pay your ransom, and we won't quietly make the ransom payment for you and present it as a recovery. This practice does happen in the ransomware recovery industry, and it should not. Our reasons have a lot to do with practicality and very little to do with morality. A significant portion of people that have paid a ransom to get their data back have received a decryptor that was broken, partially functional, or never arrived at all. Once you've identified yourself as someone willing to pay, you'll most likely become the target of additional attacks, as this is a well-documented pattern. There may be sanctions exposure for paying the group involved. And every single ransom paid provides the money for the next attack, potentially against someone close to you.
There is a single exception to the pessimistic outlook, and it is worth at least ten minutes of your time. A few strains have been cracked, and free decryption tools are published by law enforcement and cybersecurity researchers through the No More Ransom project. Before you do anything, take your note and a sample encrypted file and check there first. It costs nothing, and sometimes it ends the problem completely in the course of an afternoon.
Practicalities. Ransomware recovery here is forensic work. This means the fee is paid upfront once you accept the fixed quote, rather than the usual basis where you only pay if we recover your data. It also means all work is done with a documented chain of custody, should an insurer, a regulator or a solicitor need to see one at a later date. We don't ask you to send us your entire server rack, just the storage media (the hard drives or SSDs), labelled by bay if these were removed from servers or NAS devices. Once we have given you a quote, you can send the storage media to our Cambridge office tracked and insured, or bring it in yourself. There is no collection service, so nothing waits on a van.
The assessment itself is free and takes up to 2 working days to complete from arrival. It will tell you which data was encrypted, what can be recovered from deleted originals, whether a published decryptor applies, and how much it would cost to fully restore your data as one fixed figure. There are many large employers in Norfolk, including food processing and packing companies, agricultural cooperatives and offshore supply chain companies based in Great Yarmouth, who operate systems where the loss of records for even a week would far exceed the price of the assessment, and they are all welcome to call 0800 689 0668 prior to making any decisions.
In most attacks the expensive loss is not the encryption itself; it is the backup that ran on schedule a few hours later. Stop all automatic backups, snapshots and syncs as soon as an infection is confirmed, before your own automation replaces the last remaining good versions with locked ones.
Free diagnostic inside 2 working days of arrival and a fixed quote; on logical faults you only pay if we recover your data. Start online or ring the freephone now.