Cause of loss · ransomware
Ransomware scrambles every file it can touch and wrecks whatever would have saved you — then charges you to undo its own work. Our line does not move: we pull data from backups, surviving shadows, free space and the shortcuts these strains take, and we never pay, bargain with or contact attackers for anyone.
Speak to an engineer about it
0800 6890668
| On screen | What that tells you | First step |
|---|---|---|
| Every file now carries an added extension (.akira, or a random one unique to you) | The encryptor has already run — Qilin issues a fresh extension to each target | Photo first, then unplug it |
| Every folder holds an akira_readme.txt | The Akira note — also seen as powerranges.txt or fn.txt | Keep the notes in place |
| README-RECOVER- | The Qilin note, named from the extension assigned to you | Retain them all |
| RECOVER- | Note format from the BlackCat/ALPHV line | It's evidence, not junk |
| Your wallpaper swapped for a set of demands | Extortion styled as a lock screen, with a Tor address | Capture the screen, then restart |
| No shadow copies, and vssadmin delete shadows logged | The intruder killed off Windows' restore points so you could not roll back | It points our search elsewhere |
As soon as it lands with us, your device gets its own case number. An engineer works out the fault, says what can genuinely be pulled off, then puts one fixed price in writing — no charge for diagnosis, no obligation, and no chargeable work until you approve it.
Affected machines come off the network and are imaged end to end, free space included, since usable originals often sit there. Notes, wallpapers and lock screens are kept intact — they are evidence.
Many strains duplicate a file, encrypt the copy and delete the original — stranding it in free space, where careful carving reaches it. We check surviving shadow copies, part-scrambled large files, NAS snapshots, and whether a genuine free decryptor exists for that strain.
Whatever we get back goes onto fresh media, never onto the machines that were breached, and it arrives with paperwork you can put behind an ICO notification and an insurance claim.
You sign off a complete list of the recovered files first; only then does the recovery fee fall due. Everything returns on fresh media, postage paid, and the job stays open until you confirm the files open at your end.
What the numbers say about refusing: Sophos found in June 2025 that 97% of organisations whose files were encrypted did get their data back, though only 49% paid; in Coveware's caseload the share paying fell to a record low of 23% by Q3 2025. The British Library turned down a demand of roughly £600,000 in 2023 and rebuilt instead. Paying is neither necessary nor dependable — just the loudest button on the screen.
Where we come in: the data side — imaging, recovery, a clean rebuild, and the paperwork your insurer and ICO notification will want. We don't negotiate, and we'd never advise it.
This variant duplicated each file, locked the duplicate and wiped what it had copied from — which left the real files sitting in free space, ready to carve, next to a NAS snapshot the intruder overlooked. The business was trading again within seven days. No ransom, no contact.
No. British law enforcement and the ICO both advise against paying: it bankrolls the next attack, buys no guarantee that your files return, and the ICO has stated openly that paying will not lessen your regulatory exposure. We will not help arrange a payment of any kind.
Frequently, in part or in full — via backups, shadow copies that survived, originals abandoned in free space by copy-encrypt-delete variants, NAS snapshots, or a free decryptor if one truly exists for that variant.
Start with No More Ransom, the genuine repository operated alongside Europol. No decryptor exists for Qilin, Medusa, INC, RansomHub, or the current builds of Akira and LockBit; anyone offering one is selling you a recovery service rather than a key.
A business should report it to Report Fraud (once Action Fraud, 0300 123 2040) and to the NCSC — and where personal data is probably exposed, tell the ICO inside 72 hours, as UK GDPR requires.
Powering a damaged device up again costs you data. Start a case first; diagnosis is free whatever you decide.