Ransomware has hit you
Encrypting a whole network before morning means working fast, and fast work is sloppy work. That is our opening. A shadow copy the script walked past. A snapshot still sitting on the NAS. Originals deleted but not yet overwritten, waiting in free space. Large files locked in patches. Cases come to us from Cardiff, Newport and the valleys — and we deal with your data only, never with the people who encrypted it.
Describe the symptoms to an engineer
0800 6890668
| Warning signs | What has gone wrong | Do this now |
|---|---|---|
| Every file has picked up a new ending — .akira, or a random string issued just to you | The encryption finished. Qilin hands each victim its own extension | Photograph it, then pull the power |
| akira_readme.txt in every folder you open | Akira's ransom note. Other crews drop powerranges.txt or fn.txt | Leave them exactly where they are |
| README-RECOVER- | Qilin once more — your extension goes into the note's name | Keep every copy |
| RECOVER- | That naming belongs to BlackCat/ALPHV | Evidence. Hold on to it |
| A demand where your wallpaper used to be | It sends you to a Tor address to start talking | Get a photo of the screen first |
| No shadow copies survive, and the log shows vssadmin delete shadows | The restore points were wiped so Windows cannot roll back | Helpful, oddly — it shows us where to look |
The diagnosis costs you nothing. Every item that arrives is logged under a case number of its own, and an engineer works out what has actually failed — then tells you plainly which files can come back and which cannot. The price follows that: one fixed figure, in writing, and no work begins until you have read it and said go ahead.
The first move is isolation: any infected machine comes off the network. Then every drive is copied end to end, free space included, since untouched originals are often still in there. Nothing is tidied away, either. Ransom notes, swapped wallpaper, lock screens: all of it belongs in the case file.
A lot of strains never encrypt the file where it sits. They read it, write a locked duplicate and delete the first — and a deletion only takes away the pointer. Until something new needs that space, the original is still on the disk, and patient carving lifts it out intact. We chase the rest as well: shadow copies the run missed, NAS snapshots, big files it only part-locked, and a genuine decryptor if one exists for your strain.
None of it returns to hardware the attack reached. Files come back on media bought new for the job, with a written account of the work solid enough for an insurer or the ICO.
Nothing is billed while you are still deciding. A complete listing of what came off the drive reaches you first, and the invoice only follows your yes. Files travel back on media bought new for the job, return postage ours, and we do not close it here until every one of them opens on the machine you will use.
Most victims now refuse: of the organisations Sophos surveyed in June 2025, 97% saw their data come back, and 49% of them had paid. Coveware logged its lowest payment rate yet in Q3 2025 — 23%. The British Library, facing a demand near £600,000 in 2023, turned it down and rebuilt from nothing. Money buys no certainty, and it was never the sole route through — only the route being sold to you.
The data is our end of it: imaging the disks, getting back what can be got back, rebuilding on hardware we know is clean, and writing the job up in the form an insurer or the ICO expects. We open no channel to the people who did this, and we would advise nobody else to.
The ransomware never encrypted anything in place. It read each file, wrote a locked copy and deleted the original — so what mattered was still sitting in free space, and could be carved back out. A NAS snapshot nobody had thought of covered the rest. They were trading again inside the week, without paying a penny or answering the note.
No — and we will not arrange it for you. Both UK policing and the ICO tell you not to. The money funds the next victim's attack, nobody is obliged to send a key that actually works, and the ICO has said plainly that paying counts for nothing when a breach is assessed. Sending money to criminals is not something we do.
Often good, whole or in part. The sources we work from: backups you already hold, a shadow copy the attack failed to clear, snapshots kept on a NAS, deleted originals lying untouched in free space, and occasionally a legitimate free decryptor released for that exact build.
Start at No More Ransom — Europol supports it, and its list is the honest one. Right now nothing works against Qilin, Medusa, RansomHub or INC, and nothing against current Akira or LockBit builds. If someone is charging you for a key to any of those, what they are actually selling is recovery work.
Report Fraud takes it on 0300 123 2040 — the old Action Fraud number — and any business ought to loop in the NCSC too. Should personal data have gone with it, UK GDPR gives you 72 hours to notify the ICO.
A failing drive has only so many starts left in it. Spend none of them. Keep the power off, and the free diagnosis will tell you what is still readable.