Register For Our Mailing List

Register to receive our free weekly newsletter including editorials.

Home / 202

How I lost my files to ransomware

[This article from 2015 is republished as background to the largest global ransomware attack ever in the last week. Circumstances are different this time but many of the issues around backing up data are the same].

This is a cautionary tale, at the risk of embarrassing myself. I did not even know what 'ransomware' was until it infected my computer. This article is not a definitive piece on how to protect yourself from a virus. The main message is don’t do as I did.

Ransomware is a type of malware that prevents access to computer files until the victim pays a ransom to regain access or retrieve the data.

How was I tricked?

Let’s start at the beginning to at least give me some excuses. I had been exchanging emails and phone calls with Telstra, as part of a significant upgrade to faster broadband speed, higher data allowance and upgraded mobile phone plan. In my defence, my head was in a ‘Telstra numbers’ mode, full of megabytes and download speeds.

Then a few days after my upgrade, I received an email, supposedly from Telstra Customer Care, telling me I was over 50% of my monthly data allocation, with a link to my usage level. How could that be? I had only just changed to the new package. Immediately preparing myself to call Telstra and tell them to get their act together, that they had me on the wrong plan, I clicked on the link to check the numbers. Bad mistake, a strike at my soft underbelly.

The email was not from Telstra. This message jumped up on my screen.

It was a ransomware virus called CryptoLocker. Google it if you want to know more. It works by encrypting all the files on your computer, and to unlock or decrypt them, you pay a ‘ransom’ to receive a decryption key. I immediately removed the virus but it was too late. All my files – Word, Excel, PowerPoint presentations, photographs, videos – were encrypted and could not be opened. The ransom requested was GBP700, payable in Bitcoins. They said if I tried to remove the virus, it would not decrypt the files and the cost of the key would increase to GBP1,400.

Searching online for a solution, some people suggested there is a publicly available key to decrypt the files, but this is a public key used by other malware scams. My understanding is CryptoLocker uses two keys: one to encrypt and another to decrypt the data. The decryption key is a private key, which is not available other than by paying the ransom.

What about my backup?

I immediately contacted my technical support, who said this was a particularly nasty virus, and industry advice is not to pay the ransom as most people do not receive the decryption code after payment. An online search confirmed this, while others said they did not want to encourage criminals by paying the ransom. It was better to rebuild from backups.

Where were my backups? This is the embarrassing bit.

First, we tried ‘System Restore’, which if enabled on the computer, should hold shadow copies of files. But when we clicked on ‘Previous Versions’, nothing was there.

Second, what about back-ups to external hard drives? I had been told some months earlier that there are only two types of external hard drives: those that have stopped working, and those that are about to stop working. A company called Backblaze, which runs 25,000 external hard drives continuously in its backup business, reports a 5% fail in the first 18 months, and 22% in four years. No doubt this is unfair, but I used it as an excuse not to back up to external hard drives more regularly.

Third, my computer had been set up to copy files regularly to Dropbox. When I went into my Dropbox account, the files there were also encrypted. So I wrote to Dropbox asking if they had saved previous versions. There ensued an exchange of emails with Dropbox, such as:

“I’d be happy to help you roll back your entire account to a certain point in time. Could you go to and send me the link indicating the first event you would like to undo? Your account will be reverted to before this event took place.”

But over many exchanges of email, we could not open my old files. I don’t blame Dropbox for this, we just ran out of time and patience.

So where did I eventually find some of the lost files? I had older files on an external hard drive from my last (too long ago) back up. Otherwise, I retrieved wanted files that had been attached to emails: photographs, documents, spreadsheets. I recovered a decent amount stored by Google on gmail (and it would be the same with any reputable email service) and all Cuffelinks files are ‘in the cloud’.

But I did lose a lot of personal material. I had copied photographs to my computer from my iphone to free space on the phone. Other personal records, documents and spreadsheets, were lost.

What are the lessons?

All it takes is one email from a trusted friend or a familiar company, complete with logo and well-designed customer letter, plus a moment’s lack of the usual caution and this could happen to you. The lessons are:

  1. Always pause before opening a link, regardless of who it is from, and make sure it is legitimate. Hackers have ways of accessing your contacts and companies you deal with.
  2. Back up to an external hard drive regularly, but make frequent checks and hardware upgrades.
  3. Store additional copies in the ‘cloud’.
  4. Activate the programme which stores shadow copies.
  5. Email important documents to yourself. From my experience, this is a robust solution, and if anyone thinks it is not, let me know.

Repeating, I am not a technical expert on this subject, and I welcome comments from people who know a lot more than I do. (See comments in original version of this article). Including the best ways to back up.

Comment by Tony Cuffe who works in technical support

This type of invasive software is, unfortunately, becoming more common. It opens up a lot of discussion as to how to avoid it in the future. Backing up properly is a form of risk management.

For Mac users, I suggest that an Apple Time Machine is installed as well as using a programme such as Carbon Copy to do remote backups of valuable files such as photos and documents on a regular basis to remote drives. These can be setup to run automatically in the background.

For Windows users, this is not so simple. There are a range of different solutions from different suppliers. One that seems pretty good is from Acronis. They do both automatic updates to local remote drives and also the cloud.

Speaking of cloud, we are now primarily using Google Drive along with the full suite of Google apps for work applications. This means that all files are being kept in the cloud and are not touchable with programmes like CryptoLocker. We are currently retiring our laptops and replacing with them with Chromebooks. The only thing needed is an internet connection via wi-fi and you have everything available.

Finally, as for email, using a hosted cloud service such as Apple iCloud or Google Gmail is the only way to go as you can easily re-download your email to any device whether it be Windows, Apple or Linux. I use both for different email addresses but my first choice is now Gmail and particularly Gmail for business so you can set up your own domain name for your email address.


Graham Hand is Managing Editor of Cuffelinks. This article is a general warning and does not consider the personal circumstances of any readers, nor is it intended as a definitive solution to protecting data and files. It is not specifically related to the global ransomware virus attack of May 2017 but the issues are similar.

May 19, 2017

I keep all my data on a desktop which is not connected to the internet. The data is backed up weekly on a number of detachable HDs that are stored in separate locations. I use a protected laptop for internet access and downloading records. I also use no third party storage. How paranoid is all that?

May 18, 2017

For private users,there are simple ways to greatly reduce or completely eliminate the risks with ransomware and other malware, without getting involved in complicated ,time consuming and unnecessary methods.
There is usually some very obvious sign if emails are not genuine-if in doubt just contact the company,before making that fatal click.

Anti malware security software should be installed-recommended against ransomware are CheckMal AppCheck(free for private use),Zemana AntiMalware and VoodoShield..
All have excellent records of stopping malware and ransomware,they run lightly and can substitute for antivirus software,which quite often have failed against ransomware.
AppCheck just tested and successfully stopped the current WannaCry ransomware.

Backup of the whole system and data, in other words the complete content of your main drive,at least on a daily essential
Strongly recommended is Macrium Reflect,which will do this and can even be scheduled to backup each hour.
Have been using for 15years -100% reliable!

The backup image will initially be saved on the main C disk,but should be transferred to external disks regularly.
I backup daily and transfer weekly,its up to you-its pain free and simple.
If you do it daily,then at worst you would lose very little data as the emails should repopulate automatically.
I use a small external portable, cost $75,also a USB stick as a failsafe-also 100% reliable so far.
The externals should be disconnected between usage,otherwise an unlikely successful attack could spread to them.
Its surely pointless to become paranoid about using the internet ,which defeats the whole point of having it.
You may as well just stop using your computer if it becomes such a nightmare.

May 18, 2017

Fortunately I have not had any data problems for about a decade. My plan is simple:
o I never keep any data on PC/laptops (they regularly crash or get viruses),
o never use PC backup/restore software (they have never worked in the past when I needed them),
o only ever use PC/lap-tops for back-ups (but they crash/die regularly so are not much good even as backups),
o never use compressed/zipped file backup services (because you can never decompress/unzip them when you need them),
o never use the ‘cloud’,
o never use Dropbox.
o Never use auto backup tools (they miss files and/or put them in places I can never find again)
o All my working files are on USB drives + backed up every day to other USB drives (hard disc and memory types – only takes a couple of minutes per day to manually back up what I have done each day).
o I also have no social media accounts – no Facebook, Snapchat, Instagram, Twitter, Pinterest, Flickr, Tumblr, Google+, Reddit, or anything else. I Don’t even know what they are. (I do have a LinkedIn page I visit about once a year to delete ‘skills’ people accredit me with – but I’ve lost the password).


Leave a Comment:



Cybercrime response may slow internet


Most viewed in recent weeks

10 reasons wealthy homeowners shouldn't receive welfare

The RBA Governor says rising house prices are due to "the design of our taxation and social security systems". The OECD says "the prolonged boom in house prices has inflated the wealth of many pensioners without impacting their pension eligibility." What's your view?

Three all-time best tables for every adviser and investor

It's a remarkable statistic. In any year since 1875, if you had invested in the Australian stock index, turned away and come back eight years later, your average return would be 120% with no negative periods.

The looming excess of housing and why prices will fall

Never stand between Australian households and an uncapped government programme with $3 billion in ‘free money’ to build or renovate their homes. But excess supply is coming with an absence of net migration.

Five stocks that have worked well in our portfolios

Picking macro trends is difficult. What may seem logical and compelling one minute may completely change a few months later. There are better rewards from focussing on identifying the best companies at good prices.

Let's make this clear again ... franking credits are fair

Critics of franking credits are missing the main point. The taxable income of shareholders/taxpayers must also include the company tax previously paid to the ATO before the dividend was distributed. It is fair.

Welcome to Firstlinks Edition 424 with weekend update

Wet streets cause rain. The Gell-Mann Amnesia Effect is a name created by writer Michael Crichton after he realised that everything he read or heard in the media was wrong when he had direct personal knowledge or expertise on the subject. He surmised that everything else is probably wrong as well, and financial markets are no exception.

  • 9 September 2021

Latest Updates

Investment strategies

Joe Hockey on the big investment influences on Australia

Former Treasurer Joe Hockey became Australia's Ambassador to the US and he now runs an office in Washington, giving him a unique perspective on geopolitical issues. They have never been so important for investors.

Investment strategies

The tipping point for investing in decarbonisation

Throughout time, transformative technology has changed the course of human history, but it is easy to be lulled into believing new technology will also transform investment returns. Where's the tipping point?

Exchange traded products

The options to gain equity exposure with less risk

Equity investing pays off over long terms but comes with risks in the short term that many people cannot tolerate, especially retirees preserving capital. There are ways to invest in stocks with little downside.

Exchange traded products

8 ways LIC bonus options can benefit investors

Bonus options issued by Listed Investment Companies (LICs) deliver many advantages but there is a potential dilutionary impact if options are exercised well below the share price. This must be factored in.


Survey responses on pension eligibility for wealthy homeowners

The survey drew a fantastic 2,000 responses with over 1,000 comments and polar opposite views on what is good policy. Do most people believe the home should be in the age pension asset test, and what do they say?

Investment strategies

Three demographic themes shaping investments for the future

Focussing on companies that will benefit from slow moving, long duration and highly predictable demographic trends can help investors predict future opportunities. Three main themes stand out.

Fixed interest

It's not high return/risk equities versus low return/risk bonds

High-yield bonds carry more risk than investment grade but they offer higher income returns. An allocation to high-yield bonds in a portfolio - alongside equities and other bonds – is worth considering.



© 2021 Morningstar, Inc. All rights reserved.

The data, research and opinions provided here are for information purposes; are not an offer to buy or sell a security; and are not warranted to be correct, complete or accurate. Morningstar, its affiliates, and third-party content providers are not responsible for any investment decisions, damages or losses resulting from, or related to, the data and analyses or their use. Any general advice or ‘regulated financial advice’ under New Zealand law has been prepared by Morningstar Australasia Pty Ltd (ABN: 95 090 665 544, AFSL: 240892) and/or Morningstar Research Ltd, subsidiaries of Morningstar, Inc, without reference to your objectives, financial situation or needs. For more information refer to our Financial Services Guide (AU) and Financial Advice Provider Disclosure Statement (NZ). You should consider the advice in light of these matters and if applicable, the relevant Product Disclosure Statement before making any decision to invest. Past performance does not necessarily indicate a financial product’s future performance. To obtain advice tailored to your situation, contact a professional financial adviser. Articles are current as at date of publication.
This website contains information and opinions provided by third parties. Inclusion of this information does not necessarily represent Morningstar’s positions, strategies or opinions and should not be considered an endorsement by Morningstar.

Website Development by Master Publisher.