What you’re seeing
- Ransomware encrypted the servers, and the backup files on the NAS or repository are also encrypted or missing.
- The backup server's console shows jobs deleted, retention changed or restore points removed.
- Cloud backup storage was emptied or the account credentials were changed.
- A ransom note appears on the backup server as well as production machines.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The backup server was joined to the same domain, so attackers with domain admin rights could reach it.
- Backup storage was a network share writable from compromised servers.
- No immutable, offline or air-gapped copy of the backups existed.
- The backup console and cloud storage accounts used passwords without multi-factor authentication.
- Attackers spent days inside the network, deliberately disabling backups before launching encryption.
Why it matters
Modern ransomware groups target backups first because destroying them makes victims more likely to pay. Without a clean copy, the business faces lengthy rebuilds, permanent data loss or a ransom payment with no guarantee of recovery. Downtime can stretch into weeks and affect payroll, customer orders and regulatory obligations. Keep affected systems disconnected, preserve evidence and involve your insurer and legal counsel early.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Is there any hope of getting data back?
Sometimes. Older copies, cloud versions, shadow copies, offline drives or remnants on storage can survive an attack, and those are worth searching before deciding anything else.
Should we pay the ransom?
That is a business and legal decision best made with your insurer and counsel. Payment does not guarantee working decryption, and some payments carry legal restrictions.
Can you help us assess what survived?
Yes. Our certified US engineers can help review remaining systems and storage in a remote secure session once it is safe to connect.