Everything has been encrypted
Locking an entire network in one night is a rush, and a rush is careless. That carelessness is where your files come from: a snapshot left behind on the NAS, a shadow copy the run never got near, deleted originals still lying in free space, a large file encrypted only in patches. Work reaches this bench from Plymouth, west Devon and Cornwall. We deal with the data. Nobody here talks to whoever did this.
You will be talking to an engineer
0800 6890668
| What happens | What that points to | What to do |
|---|---|---|
| Every filename has picked up a suffix: .akira, or a character string issued to you alone | The encryption completed. Qilin hands each victim a different extension | Photograph it, then pull the network lead |
| akira_readme.txt in every single folder | Akira's note. Others go with fn.txt or powerranges.txt | Do not touch a single one |
| README-RECOVER- | Qilin again; the note is named for your extension | Keep the lot |
| RECOVER- | That is how BlackCat/ALPHV names its notes | Evidence. Do not delete it |
| A demand in place of the desktop wallpaper | The talking is supposed to happen on a Tor link | Photograph the whole screen |
| Every shadow copy gone, and vssadmin delete shadows in the log | Rollback is finished — Windows has nothing left to restore from | Oddly it helps us; it says where to begin |
Whatever arrives is booked in under a case number on the day it reaches the bench. An engineer then works out the actual fault, and that part is free. You get a plain answer on what can come off the drive and what cannot, followed by one price in writing. Nothing further happens until you have read it and agreed.
Anything infected leaves the network before it is touched. Then each disk gets a full image, free space and all, since the untouched originals are usually still lying there. Nothing is tidied. Ransom notes, the altered wallpaper, the lock screen: all of it goes into the case file.
Most strains do not encrypt in place. They read the file, write an encrypted copy next to it, then delete the source — and deleting removes the pointer and nothing more. Those bytes remain on the disk until some other file claims the room, so carving them out whole is routine. The remaining routes are worked just as hard: shadow copies missed by the run, snapshots on the NAS, big files locked only in patches, and a real decryptor where one has been published for that strain.
Nothing is returned onto equipment the attack reached. Your files come back on media bought in for the job, along with a written account of the work that will hold up for an insurer or the ICO.
Thinking it over costs you nothing. Everything the drive gave up is listed for you before any invoice exists, and the bill only follows your go-ahead. Files travel back on media bought in for your job, with return carriage paid at this end, and the case stays on the bench until you confirm they open on your own computer.
Refusal is now the ordinary answer: Sophos, surveying in June 2025, put recovery of data at 97% of organisations, with 49% having paid for it. Coveware recorded a payment rate of 23% in Q3 2025, the lowest it has measured. The British Library was asked for close to £600,000 in 2023, declined, and rebuilt. Payment guarantees nothing, and it was never the only way out — only the one on offer from the people who locked you out.
The data is our part: images off the disks, recovery of whatever can be recovered, everything returned to hardware known to be clean, and the job written up the way an insurer or the ICO expects to see it. We open no line to the attackers, and our advice is that you should not either.
The lock had been applied to copies, not to the files themselves: each original was read, a scrambled duplicate written, and the original then deleted — so what mattered was still lying in free space, waiting to be carved out. The remainder sat in a NAS snapshot nobody had thought to check. The firm was trading again within the week, having paid nothing and answered nothing.
Our answer is no, and we will not act as an intermediary either. Both police guidance and the ICO advise against it. A payment underwrites the following attack on someone else; no criminal is under any obligation to supply a key that functions; and the ICO has stated that having paid will do you no good at all in the assessment of a breach.
Frequently most of it, whole or in part. There are five sources: a backup you already have; a shadow copy the script missed; a snapshot still held on the NAS; deleted originals lying about in free space; and now and then a genuine free decryptor published for that particular build.
No More Ransom is where to look. It is run with Europol behind it and its listings do not overpromise. Right now nothing is published for Medusa, RansomHub, INC or Qilin, and nothing for the Akira and LockBit builds in circulation. Charging for a key to any of those means selling recovery work under a different name.
Cyber crime is reported to Report Fraud on 0300 123 2040 — the same service, renamed from Action Fraud. A business should file with the NCSC too. Where personal data has been caught up in it, the UK GDPR notification deadline for the ICO is 72 hours.
The diagnosis is free, and it comes back as a list: which files read, which do not, and what getting them off would take. Until then, leave the drive unplugged.