NAS units connected to the internet are a favourite ransomware target. Attacks on QNAP and Synology units have encrypted millions of family photo libraries and office shares. Recovery is often possible from what the ransomware left behind.
Where the data comes back from
- Btrfs and ZFS snapshots that were not deleted, or were only partly deleted
- Original files the ransomware deleted after writing encrypted copies
- Files the ransomware skipped or only partly encrypted
- Free decryptors for some older NAS ransomware strains
What to do now
- Unplug the NAS from the network, but leave it powered on if it is idle
- Don’t update the firmware, factory reset or “repair” the volume yet
- Photograph the ransom note and note its file name
- Call us before changing anything else
Afterwards
We help you rebuild the NAS so it isn’t exposed to the internet, switch on immutable snapshots, and set up an offline or offsite copy.
Start your recovery
Book online for a job number and shipping instructions, or call and talk to an engineer. We evaluate the drive and give you a fixed quote before any recovery work starts.