Our systems were encrypted by ransomware — can I get our files back without paying the ransom?

Watch out for brokers out there claiming they can fix it without paying the ransom. Some of them are just opportunists who turn around, pay a lower ransom behind your back, and pocket a markup. Stick with an independent digital forensics specialist.

Correction: I misremembered the figure, it was a bit lower.

Attackers usually wipe shadow copies, but sometimes the process fails midway. Once you've imaged the drive, make sure to run file recovery tools on the image to scan for leftover shadow copies or deleted temp database files.

Pulling the plug on the servers was a good first move, but shutting down without taking a memory dump might mean losing volatile encryption keys. If any machines are still running, don't turn them off—just unplug the network cable.

We dealt with a similar incident last year and they wanted 50,000 SAR. We refused to pay. We restored from a two-week-old backup and spent 4 days re-entering all the invoices one by one using bank statements and e-faturas. Our total downtime cost ended up being roughly a third of the ransom demand.

Even if you pay the ransom, there's zero guarantee the files will actually decrypt. A lot of times the keys they give you end up corrupting large files like databases, so you end up out of pocket and out of luck.

Stick to these three rules: 1) Do not plug that external drive into any machine on the current network. 2) Do not reach out to the contact addresses in the ransom note; don't let them know the system is active. 3) Do not run any antivirus or cleanup tools before taking a forensic image.

sorry to hear that then hook the backup drive up to a clean pc in read-only mode and check it out if you're lucky you can get away with just losing two weeks of data.

Under Saudi cybersecurity regulations, I would also recommend checking your legal reporting obligations to national cybersecurity authorities in the event of a potential customer data breach.

You're right. The real issue isn't the number, but what it's based on.

Thanks for writing this, that's the right way. Most incidents start with a leaked password, not a vulnerability.

The biggest time-waster for us was not knowing who had the final say. Good luck with that.

I went through the same thing two years ago. Start with a small trial; don't commit to everything at once.

People defend habits, not processes. Resistance comes from there. If you post the result here, it will help others too.

I agree.

Noted, thanks. When making decisions, write down the worst-case scenario too, not just the best.

Let me clarify the technical side. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Solutions that work at a small scale collapse when you grow; I learned this late.

Let's separate the concepts they're getting mixed up. btw most time waste accumulates in tasks waiting for approval.

I'd appreciate it if you shared the outcome. If you scold false alarms, nobody will report again.

My questions are cleared up, thanks.

the opposite happened to me, that's why I'm writing. i mean taking measures without an inventory leaves doors you haven't seen open.

if I were you, I'd go this route.