Ransomware has encrypted your files: what to do first

What does ransomware do?

Ransomware encrypts your files and demands payment to unlock them. The files usually get a new extension, and a note is left in the folders. The files are not deleted, they are encrypted; without the decryption key they cannot be read.

What matters in the first hours?

Stopping the spread is the most important step. Some ransomware also attacks network shares and connected backups. So disconnect the affected devices first, then look for a solution.

Should I pay the ransom?

Paying does not guarantee that the data will come back. In some incidents the key never arrives, or the tool you receive only unlocks part of the data. Make the decision about payment together with your organisation's legal and information security officers.

Is there a free decryptor?

For some ransomware families there are free decryptors prepared by security companies and law enforcement agencies. nomoreransom.org is a project that lists them. Not every family has a decryptor, and the wrong tool can damage your files. So first make a copy of your encrypted files.

What does the chance of recovery depend on?

The chance of recovery depends on the type of ransomware, how the encryption was applied to the disk, the state of your backups and shadow copies, and how long the device has been running. So what is possible in one incident may not be possible in another. We determine the situation through analysis and tell you in writing what is possible.

What should you do about KVKK?

If the affected data includes personal data, an obligation to report a data breach may arise under KVKK (Turkey's Personal Data Protection Law). Consult your legal adviser about the deadline and scope.

How long does it take and how much does it cost?

Standard jobs take 10 business days on average, urgent jobs 24 business hours on average. The actual time depends on the type of fault, sourcing the parts needed and the capacity of the disk. Some jobs are completed within a few hours, while others can take months.

The price depends on the type of fault, the parts needed and the time the work takes. After the analysis we send you the exact price in writing. If you do not accept the quote, you get your device back without paying. Not every case falls within the free analysis scope. For requests outside the free analysis scope, you receive written information about the analysis fee before any work begins. For details, see what determines the price and how long it takes.

Can the data always be recovered?

No. In most incidents, encrypted files cannot be opened without the encryption key. Recovery depends on factors such as backups, shadow copies or leftover data in other areas of the disk. We cannot know the outcome without carrying out an analysis. After the analysis, you will be informed about the situation.

Frequently asked questions

Should I switch off a device infected with ransomware?

Disconnect it from the network first. Experts differ on switching it off: doing so can stop the encryption, but it also wipes the traces in memory. If you are finding it hard to decide, call us.

What should I do if I have a backup?

First make sure the device has been cleaned, then restore from the backup. Check whether the backup was affected too. If the backup was connected when the attack happened, examine it as well.

Why did my encrypted files get a new extension?

Ransomware usually adds its own extension to file names. That extension can be a clue to which ransomware family you are dealing with. Keep a record of the extension and the ransom note.

Do I pay anything if I don't accept the quote?

No. If you do not accept the quote after the analysis, you get your device back without paying. In cases where it cannot be foreseen at which stage the data will become reachable, the price may be set after the data has been recovered, based on the time and resources spent on the work. In that case you are under no obligation to pay. Not every case falls within the free analysis scope. For requests outside the free analysis scope, you receive written information about the analysis fee before any work begins.

Why isn't free analysis available in every case?

For some requests a short assessment of the device is enough, and we can offer a free analysis. For other requests, our specialists can only reach an opinion or a result after spending many hours working on your device with professional tools. Because what we call the analysis stage involves carrying out the technical work that has to be done, we may not be able to offer those hours free of charge.

What do you do during the analysis?

During the analysis we actually start the professional technical work that needs to be done. Many businesses, on the other hand, say they offer a 'free analysis' to attract customers and get the device brought to them; once the device has been handed over, without spending any time on it, they say something like 'we will work on it; if it works it costs this much, if not, that much'. Having got customers to hand over their devices with the words 'free analysis', and since the customer will want the work to continue rather than go to the trouble of taking the device back, they put in no effort or time, which is how they can claim to offer a 'free analysis' in every case. In reality this is little more than a trap to attract customers.

Do you charge a service fee?

We do not charge anything under the name of a service fee. We do offer free analysis. For requests outside the free analysis scope, the analysis fee is communicated in writing at the start. Some businesses advertise with phrases like "600 TL data recovery service fee", leading customers to believe they will get their data recovered for 600 TL. That is how they attract customers. We do not work in such an unethical way.

Let's assess your situation together: call 0212 909 56 19 or write to us on WhatsApp. See our contact page for the address and opening hours.