How it failed · ransomware
Ransomware encrypts what it can reach and deletes what would save you — then asks to be paid for the privilege. Our position is fixed: we recover data from backups, shadows, free space and the strains' own shortcuts, and we never pay, negotiate with, or contact attackers on anyone's behalf.
Talk it through with an engineer
01273 964902
| What you see | What it means | First move |
|---|---|---|
| Files renamed with a new extension (.akira, or a random string per victim) | Encryption has run — Qilin generates a different extension for every victim | Photograph, then isolate |
| akira_readme.txt in every folder | Akira's ransom note (variants: powerranges.txt, fn.txt) | Don't delete the notes |
| README-RECOVER-<extension>.txt | Qilin's note, named after your victim-specific extension | Keep every copy |
| RECOVER-<id>-FILES.txt | BlackCat/ALPHV-lineage note format | Evidence, not litter |
| Desktop wallpaper replaced with instructions | Lock-screen-style extortion pointing at a Tor address | Screenshot before any reboot |
| Shadow copies missing; vssadmin delete shadows in the logs | The attacker deleted Windows' own restore points to stop you recovering | Tells us where to look instead |
Your device is logged with its own case reference the moment it arrives. An engineer assesses the fault, confirms what's actually recoverable, and you get a fixed price in writing — no diagnosis fee, no obligation, and no paid work until you say go.
Affected machines are isolated and imaged in full — including free space, where recoverable originals often survive. Notes, wallpapers and lock screens are preserved as the evidence they are.
Many strains copy, encrypt and delete — leaving originals recoverable from free space. We check surviving shadow copies, partially-encrypted large files, NAS snapshots, and whether a legitimate free decryptor exists for the exact strain.
Recovered data is restored to clean media — never back onto compromised systems — with documentation that supports your ICO notification and insurance claim.
Before you pay the recovery fee you approve a full listing of what came back. Your data returns on new media with free return postage, and the case only closes once you've confirmed everything opens on your side.
The numbers behind 'don't pay': Sophos (June 2025) found 97% of organisations whose data was encrypted got data back — while only 49% paid, and payment rates in Coveware's incident caseload fell to a record 23% by Q3 2025. The British Library refused a ~£600,000 demand in 2023 and rebuilt. Payment is neither necessary nor reliable; it's just the loudest option on the screen.
Our part: we handle the data — imaging, recovery, clean rebuilds and the documentation your ICO notification and insurer will ask for. We don't negotiate, and we'll never suggest you should.
The strain copied files, encrypted the copies and deleted the originals — so the originals were still carvable from free space, alongside a NAS snapshot the attacker missed. Trading resumed inside a week. Nothing was paid, and nothing was said to the attackers.
No. UK law enforcement and the ICO jointly discourage payment — it funds the next attack, doesn't guarantee your data back, and the ICO has said plainly it won't treat payment as reducing your regulatory risk. We never facilitate payment in any form.
Often, partially or fully — from backups, surviving shadow copies, originals left in free space by copy-encrypt-delete strains, NAS snapshots, or a free decryptor where one genuinely exists for the strain.
Check No More Ransom, the legitimate repository run with Europol. For Qilin, Medusa, INC, RansomHub and current Akira and LockBit versions, there is none — anyone selling one is selling a recovery service, not a key.
Businesses should report to Report Fraud (formerly Action Fraud, 0300 123 2040) and the NCSC — and if personal data is likely at risk, notify the ICO within 72 hours under UK GDPR.
Every restart of a damaged device costs data. Open a case first — the diagnosis is free either way.