Recover from ransomware one careful step at a time
We help you contain the damage, restore from clean backups and rebuild so the attacker cannot return.
In plain English.
Ransomware encrypts your files and demands payment for the key. Often the attackers have also copied data and threaten to publish it. It is frightening, and the first instinct is to start switching things back on. Acting carefully in the first hours makes recovery far more likely.
We help you isolate affected machines from the network without destroying evidence, work out which accounts and systems were reached, and identify clean backups to restore from. The NCSC advises against paying a ransom, and payment does not guarantee your files come back.
Recovery means rebuilding affected devices from scratch, resetting every password, restoring data from before the infection and closing the way in, which is often a stolen login or an unpatched remote access tool. We also help you report it to Action Fraud and, where personal data is involved, gather the facts for the ICO.
It suits you if.
- Your files have suddenly changed extension and will not open
- A ransom note has appeared on screens or in folders
- Your backups may also have been affected
- You need help deciding what to switch off first
- You want to rebuild properly after an attack
What we do.
Containment guidance
Clear instructions on disconnecting affected machines and accounts, without wiping the evidence needed to understand the attack.
Scope assessment
We work out which devices, servers, cloud accounts and backups were touched, and when the attack started.
Clean restore
Data is restored from backups taken before the infection, and checked before staff start using it again.
Rebuild and reset
Affected computers are wiped and rebuilt, every password reset and remote access locked down.
Reporting support
We help you gather the facts for Action Fraud, your insurer and, where personal data is at risk, the ICO within its 72-hour deadline.
Hardening afterwards
MFA, patching, immutable backups and endpoint protection put in place to make a repeat much less likely.
How it runs.
- 01
Call us first
Tell us what you are seeing. We give you immediate containment steps and agree how we will help and the cost of the first stage.
- 02
Contain and assess
Affected systems are isolated, the scope is mapped and clean backups are identified.
- 03
Restore and rebuild
Devices are rebuilt, data restored and accounts secured, with critical systems brought back first.
- 04
Report and harden
We help with reporting and put in the controls that close the gap the attackers used.
Questions people ask.
Should we pay the ransom?
The National Cyber Security Centre and law enforcement advise against it. Paying does not guarantee you get your data back or that stolen data is deleted, and it can mark you as a target. The decision is yours, and we help you understand your recovery options first.
Can you get our files back without backups?
Sometimes. Free decryptors exist for some older ransomware strains, and fragments can survive in cloud version history. We check every option honestly, but without clean backups full recovery is not always possible.
How much does recovery cost?
It depends on how many systems are affected. We price the first stage, containment and assessment, before we start, then quote the restore and rebuild once we know the scope. If you have cyber insurance, tell your insurer early, as they may have a required process.
How do we stop it happening again?
Most attacks start with a stolen password, a phishing email or an unpatched system. Multi-factor authentication, regular updates and backups that attackers cannot delete cover the biggest gaps. We set those up as part of the rebuild.
Your next chapter starts with a conversation.
Nottingham & Derby / UK-wideLet’s build
what’s next.
15 minutes with Garreth.
A real conversation about your business.