Your files are encrypted
Locking a whole network overnight is a rush job, and rush jobs are untidy. That untidiness is where the files come from. A shadow copy the script never reached. A snapshot left on the NAS. Deleted originals still sitting in free space. A big file encrypted only in parts. Work reaches us from Hull, the East Riding and North Lincolnshire. We handle the data. We do not talk to whoever did this.
An engineer will take the details
0800 6890668
| The symptoms | What the fault is | What to try |
|---|---|---|
| Filenames now carry an extra ending: .akira, or a string of characters issued to you alone | Encryption ran to the end. Qilin issues a different extension per victim | Photograph it. Pull the network lead |
| akira_readme.txt sitting in every folder | Akira's own note. Other crews use fn.txt or powerranges.txt | Leave every one of them alone |
| README-RECOVER- | Qilin again — the note is named after your extension | Keep them all |
| RECOVER- | BlackCat/ALPHV names its notes that way | That is evidence. Keep it |
| The desktop wallpaper replaced by a demand | Negotiation is meant to happen over a Tor link | Take a picture of the screen |
| Shadow copies all gone, with vssadmin delete shadows in the log | That kills any rollback — Windows has nothing to restore from | Useful to us, oddly: it tells us where to start |
Each item that arrives gets a case number the day it lands. An engineer looks at it and finds the real fault, and that costs you nothing. You are told in plain terms which files can come off the drive and which cannot. A price follows — one figure, written down. No work starts until you have seen it and agreed to it.
Anything infected comes off the network before we touch it. Every disk is then imaged in full, free space and all, because the untouched originals are usually still sitting there. We tidy nothing up. Ransom notes, the changed wallpaper, the lock screen — that all goes in the case file.
Most strains do not encrypt a file in place. They read it, write an encrypted copy alongside, then delete the source — and a delete takes away the pointer, nothing else. The bytes stay on the disk until something else claims the space, so carving them back out, whole, is ordinary work. The other routes get the same attention: shadow copies the run skipped, snapshots on the NAS, large files locked only in part, and a real decryptor where one exists for that strain.
Nothing goes back onto kit the attack touched. Your files return on media bought in for the job, with a write-up of the work that will stand up to an insurer or the ICO.
You are not billed while you are still thinking. The list of what came off the drive goes to you first, and the invoice waits on your word. Files go home on media bought in for the job, with the postage back on us. We keep the job open until you have opened them on your own machine.
Refusing is now the norm: in the Sophos survey of June 2025, 97% of organisations got their data back, while 49% had paid to do it. Coveware recorded its lowest ever payment rate in Q3 2025, at 23%. The British Library was hit for close to £600,000 in 2023, would not pay, and rebuilt. Payment buys no guarantee, and it was never the only route out — just the one being offered by the people who locked you out.
Our part is the data: imaging the disks, recovering what can be recovered, putting it back on hardware known to be clean, and documenting the job the way an insurer or the ICO will want it. We do not open a line to the attackers, and we would tell you not to either.
Nothing was locked in place. Each file was read, a locked copy written, the original deleted — so the material that mattered still lay in free space, and could be carved out again. The rest sat in a NAS snapshot no one had thought to look at. The business was trading inside the week, with no money paid and the note left unanswered.
We say no, and we will not act as a go-between. Police guidance and the ICO both advise against it. A payment pays for the next attack on somebody else. No criminal is bound to hand over a working key. And the ICO has stated that paying will not count in your favour when a breach is assessed.
Often most of it, in full or in part. Five sources do the work: a backup you already hold; a shadow copy the script did not reach; a snapshot still sitting on the NAS; deleted originals lying in free space; and occasionally a genuine free decryptor published for that build.
No More Ransom is the place to look. Europol is behind it and its list does not oversell. As things stand there is nothing for Qilin, Medusa, RansomHub or INC, and nothing for the current Akira or LockBit builds. Anyone charging you for a key to one of those is selling you recovery work under another name.
Cyber crime goes to Report Fraud on 0300 123 2040, which was Action Fraud until the rename. A business should tell the NCSC as well. If personal data was caught up in it, the UK GDPR deadline for telling the ICO is 72 hours.
Leave it switched off. A failing drive has a limited number of starts in it, and each one spends a little more. The free diagnosis will say which files can be read.