Loss caused by ransomware
We recover from ransomware for Maidenhead businesses and households alike; we do not deal with the people who caused it, and that holds for every client. The work runs the other way from the ransom note: shadow copies the run missed, snapshots on a NAS, originals left behind in free space, and the corners these strains cut in order to encrypt a network before anyone notices. Encryption reaches a great deal, but rarely everything.
Describe the fault to an engineer
0800 6890668
| The signs | The likely cause | Start here |
|---|---|---|
| Every filename has gained a new suffix: .akira, or a string generated for your network alone | The encryption pass has finished; Qilin gives each victim its own extension | Photograph it, then pull the power |
| akira_readme.txt left in every folder | Akira's ransom note; other builds drop powerranges.txt or fn.txt | Leave the notes where they are |
| README-RECOVER- | Qilin's note, named after the extension your files were given | Keep every one |
| RECOVER- | The naming pattern used by BlackCat/ALPHV | Evidence: hold on to it |
| The wallpaper replaced with a demand for money | The lock screen sends you to an address on Tor | Photograph the screen before anything else |
| Shadow copies gone, with vssadmin delete shadows in the logs | Restore points were wiped to stop you rolling Windows back | Helpful: it narrows where we look |
Nothing becomes chargeable until you have said yes to it. Each item takes a case number of its own the moment it arrives, an engineer establishes what has actually failed, and you are given a candid view of which files stand a realistic chance of returning. The single quote that follows is fixed, written down, and costs nothing.
Infected machines come off the network before anything else happens. Every drive is then imaged in full, unallocated space included, since untouched originals frequently remain there. Nothing is tidied up: notes, wallpapers and lock screens are all part of the record.
Many strains work by duplication: the copy is encrypted and the original deleted, and a deleted file is only unreferenced, not removed. Until it is overwritten, patient carving lifts it back whole. Alongside that we look for shadow copies the run missed, snapshots on a NAS, large files encrypted only in sections, and any legitimate decryptor for your variant.
Recovered files never return to hardware that was part of the incident. They come back on new media, with a written account thorough enough to put in front of an insurer or the ICO.
Nothing is billed until you have seen the recovered file list in full and told us to go ahead. What comes back arrives on new media, with the return journey at our cost, and the case stays open at this end until you have opened every file yourself.
Refusal is now the majority position: Sophos reported in June 2025 that 97% of encrypted organisations got their data back, with a payment involved in 49% of cases. Coveware's Q3 2025 figure puts payment at 23%, the lowest it has recorded. The British Library, asked for roughly £600,000 in 2023, declined and rebuilt instead. Payment buys no certainty and is not the only road back; it is simply the most audible.
Our part is the data: imaging the drives, retrieving what can be retrieved, rebuilding onto hardware that is known to be clean, and documenting all of it for an insurer or the ICO. Negotiation with the people responsible is neither offered nor recommended.
Nothing was encrypted where it lay. Each file was copied, the copy locked and the original deleted, so what mattered was still in free space waiting to be carved, and a NAS snapshot they had overlooked filled the gaps. Trading resumed inside the week, nothing paid and no one answered.
No. British policing and the ICO are aligned on this: do not pay. The money underwrites the following attack, nothing about a payment obliges anyone to return your files, and the ICO has stated plainly that paying will not improve how a case is viewed. We do not process payments to attackers.
Often they can, whole or in part. The routes are backups, shadow copies the run failed to remove, NAS snapshots, originals left in free space by a strain that copies before it encrypts, and sometimes a genuine free decryptor for that build.
Begin at No More Ransom, the genuine archive Europol supports. Nothing at present opens Qilin, Medusa, RansomHub, INC, or the current LockBit and Akira builds, so anyone advertising a key for those is selling recovery labour under another name.
Yes. Report Fraud, formerly Action Fraud, takes it on 0300 123 2040, and a business should raise it with the NCSC as well. If personal data has more likely than not left the building, UK GDPR allows 72 hours to notify the ICO.
Each further power-up asks more of a drive that has already begun to fail. Open the case first and let the free diagnosis tell you what is left.