How it was lost · ransomware
A ransomware attack locks every file it can reach, then goes after the safety nets — backups, restore points — before asking you to buy back your own work. We take the other road: shadow copies that survived, originals stranded in free space, snapshots, the corners these strains cut. Paying, haggling or contacting the gang — we do none of it, for anyone, Exeter included.
Talk it over with an engineer
0800 6890668
| The error | What it usually means | Step one |
|---|---|---|
| Every file now ends in .akira — or in a random string minted for your network alone | Encryption has already finished; Qilin hands a different extension to every victim | Photograph it, then pull the plug |
| An akira_readme.txt sitting in each folder | Akira's ransom note; variants drop powerranges.txt or fn.txt instead | Leave every note where it is |
| README-RECOVER- | Qilin's note — it takes its name from your assigned extension | Keep the lot |
| RECOVER- | The BlackCat/ALPHV family's naming pattern | Treat it as evidence |
| Desktop wallpaper replaced by a ransom demand | A lock-screen shakedown pointing to a Tor address | Photograph the screen first, restart after |
| Shadow copies gone — vssadmin delete shadows in the logs | Windows' restore points were wiped by the attacker to block any rollback | Tells us where to look instead |
Your device is logged under its own case number the day it arrives. An engineer finds the fault, tells you plainly what stands a real chance of coming back, and writes you one fixed quote. Nothing is charged for that look, nothing obliges you, and paid work starts only when you say so.
First job: infected machines leave the network. Each drive is then imaged in full — free space too, because intact originals are often lying in it. Ransom notes, wallpapers and lock screens all stay put; that's your evidence.
Plenty of variants work copy-first: encrypt the duplicate, bin the source. That binned source sits in free space, and patient carving brings it out. We also look for shadow copies the attacker missed, NAS snapshots, big files only partly scrambled — and check whether that strain truly has a free decryptor.
Recovered data never goes back onto compromised machines — it comes to you on new media, with documentation written to stand behind an insurance claim or an ICO report.
Before any fee falls due you see a full listing of everything recovered and approve it. Your files travel back on brand-new media, return postage on us, and the case stays open until you've confirmed everything opens on your own machine.
Refusing to pay is normal now: in June 2025 Sophos reported that 97% of encrypted organisations recovered their data, yet only 49% had paid. Coveware's caseload shows payment rates at a record low — 23% by Q3 2025. In 2023 the British Library refused a demand of around £600,000 and rebuilt from scratch. A ransom is neither the reliable route nor the only one — it's simply the option shouting loudest.
Our part is the data: imaging drives, recovering files, rebuilding clean, and producing the records your insurer and the ICO will ask for. Negotiating with attackers isn't a service we offer — or one we'd ever recommend.
Rather than encrypting in place, this strain copied every file, locked the copy and deleted the original — so the originals still lay in free space where we could carve them, alongside a NAS snapshot the attacker had missed. Seven days later the firm was back trading. Nobody paid, nobody spoke to them.
No. The ICO and UK policing agencies both say don't pay: money funds the next wave, nothing guarantees your files come home, and the ICO is on record that paying does not soften your regulatory position. Arranging payment is something we simply won't do.
Often, wholly or partly. The routes: backups, shadow copies the attack missed, originals still sitting in free space where a copy-encrypt-delete strain left them, NAS snapshots — or a genuine free decryptor where one exists for the variant.
Go to No More Ransom first, the legitimate archive run alongside Europol. No working decryptor exists for Medusa, Qilin, RansomHub, INC, or the current builds of LockBit and Akira — anyone claiming one is selling recovery work, not a key.
Businesses should notify Report Fraud on 0300 123 2040 (it was formerly Action Fraud) and the NCSC; if personal data has likely been exposed, UK GDPR gives you 72 hours to inform the ICO.
Each power-up of a failing device takes more data with it. Open a case first — the look-over is free whichever way it goes.