Stop all of the computers involved from using the network or the internet by unplugging the cables and turning off the Wi-Fi, but do not delete anything, and do not remove power from the NAS or server yet. Don't format or reload Windows, as this will destroy some of your best chances of recovering data. Take a photo of the ransom note and make a note of the new file extension on your encrypted files. Stop all backups now, so that freshly encrypted files don't overwrite your last good backup.
If your business is covered by UK GDPR and the attack involved an individual's personal information, this could be considered a reportable breach. Consider bringing in whoever handles your data protection compliance now.
Route one: copies that were missed by the ransomware. Backups on offline and off-site media, cloud version history (OneDrive, SharePoint, Google Drive and Dropbox will all let you go back to versions of a file from before the attack), NAS snapshots and Windows shadow copies. Modern strains do try to wipe shadow copies and NAS snapshots, but 'try' is the key word, and we routinely find them partly intact.
Route two: free decryptors. Researchers and groups such as the "No More Ransom" project have cracked several strains of ransomware and released free decryption tools. The process is determining the exact strain, through the ransom note and file extension, to find out if you are lucky. Never give money to a 'decryption' service offered on some unknown website; usually they are just paying the criminals for you, or taking your money and disappearing.
Route three: lab recovery of what the encryption missed. In general, encrypting an entire estate of files takes a while to do, so many of these attacks get cut off before completion. On actual jobs, we've found many untouched files on secondary storage devices, old versions of files stored in unallocated disk space, entire virtual machine snapshots, database backups the malware never parsed, and half-encrypted files where only the opening blocks are damaged. Essentially this is ordinary data recovery craft applied to an unusual crime scene: imaging all the drives involved, using forensic tools and doing a file-by-file audit of what was recovered.
The final option is to pay, though this should be avoided on practical as well as ethical grounds: multiple studies show that a large portion of people who pay receive nothing usable in exchange, and once you have paid you are likely to be seen by other crews as an easy target. The UK authorities advise against paying at all, and if sanctioned groups are involved, making a payment could create legal liability of its own. Work through the three routes above first: most businesses who come to us assuming they will 'have to pay' turn out to have far more surviving data than they feared.
File a report with Action Fraud and keep all of your evidence, as it's free to do this. Sometimes the strain that hit you gets broken months later, and at that point the encrypted drives you saved suddenly become recoverable.
Start by getting a quote via either the phone or the free online diagnostic. Then post the affected drives to us using tracked and insured postage: pull the disks from the servers and label them by bay, without the chassis or controller, and take the disks out of the NAS unit if possible (otherwise send the NAS itself). We create an image of everything prior to beginning any form of analysis. No original disks ever have any kind of processing done directly to them. You will receive a report detailing what can be recovered through all three routes, along with one fixed written quote. All ransomware recovery projects are classed as forensic work, therefore the agreed quote is payable upfront. If you are experiencing an active incident, please call us on 0800 689 0668, tell us it is live, and we will move your project to the top of our queue.
Details about this service are available on our ransomware data recovery page. See also NAS recovery, RAID recovery and SAN & virtual machine recovery: these are where businesses tend to store their data most often when they fall victim to ransomware.
Stop running backups immediately. Any backups which run automatically after encryption will write over your last good copy of files/data with the now-encrypted version, effectively turning a very bad day into complete disaster.
Free diagnostic, fixed quote, and in most cases you only pay if we recover your data. Start now or call the freephone.