Hit by ransomware? Call before you pay.
Files renamed with a strange extension, a ransom note on every desktop, servers and backups locked. We help UK businesses work out what can be recovered without paying, and how to get running again.
The first hour
- Disconnect affected machines from the network; don’t switch servers off unless told to
- Don’t delete the ransom notes or the encrypted files
- Don’t reinstall Windows or restore over the top of encrypted drives
- Disconnect backup drives and NAS units that aren’t yet affected
- Note the file extension and the ransom note’s name; they identify the strain
Ways to get data back
Paying is not the only option, and it’s no guarantee. Depending on the ransomware and how far it got, data can often be recovered from:
- Files the ransomware hadn’t finished encrypting
- Shadow copies, snapshots and old versions it missed
- Deleted originals still on the disk after encryption
- Databases and virtual machine files that are only partly encrypted
- Known weaknesses in some ransomware strains
Reporting it in the UK
Report cyber crime to Report Fraud, the police service that replaced Action Fraud (reportfraud.police.uk or 0300 123 2040), or, in Scotland, to Police Scotland on 101. If personal data may have been affected, a business may need to report it to the ICO within 72 hours. We can give you what you need for both reports.
Price
Every ransomware case is different, so we quote after a free assessment of the encrypted files and the systems involved. Call 020 7237 6805 and an engineer will talk you through it.