What to do when malware encrypts synced cloud files

Ransomware can damage files stored on a Windows or Mac computer and then transmit those changes through OneDrive or Google Drive synchronization. If an encrypted document replaces a healthy cloud copy, every connected device may display the unusable version. This can look like a cloud breach, although the original infection often began on one computer.

The priority is to stop synchronization before attempting recovery. Do not rename encrypted files, reinstall the operating system immediately, or delete cloud data in frustration. Those actions can remove useful evidence and reduce the chance of restoring earlier versions.

Recognize what happened

Encrypted files commonly have an unfamiliar extension, altered filenames, or a ransom note in affected folders. Open a few files only if necessary; repeated attempts will not decrypt them and could activate malicious scripts in some formats. Photograph or save the ransom note and record when the changes began.

Check whether the damage exists only on the computer or also in the online account. Use the OneDrive or Google Drive website from a separate, trusted device. Compare recent file activity, folder contents, and file timestamps without downloading suspicious items.

A sudden wave of changes across documents, images, archives, and project folders strongly suggests ransomware. A smaller group of modified files may indicate a defective application, accidental overwrite, or malware with a narrower target, but it still requires investigation.

Stop the synchronization and infection

Pause OneDrive or Google Drive on the affected computer, then disconnect it from Wi-Fi and wired networks. If other computers share the same account or folder, pause synchronization on those devices as well. Do not reconnect the infected machine simply to check whether files have returned.

Keep the computer powered off if you cannot safely isolate it. For an organization, contact the administrator or security team before changing account settings. Preserving logs, timestamps, and the encrypted samples can help identify the strain and determine whether a legitimate decryptor exists.

Remove the malware before restoring files to the same computer. If an antivirus program reports a detection that will not disappear, follow a careful persistent detection guide rather than repeatedly ignoring the alert.

Check cloud recovery options

Cloud synchronization is not the same as a separate backup. If ransomware changes a file locally, the sync client may upload the encrypted copy and place the previous version in a recoverable history. Recovery depends on the provider, subscription, account type, retention settings, and how long ago the encryption occurred.

Use a clean device and sign in through the official OneDrive or Google Drive website. Avoid opening downloaded files until the computer has been scanned. If an account appears compromised, first secure it and preserve the available recovery history before making large-scale changes.

Recovery source	What to check	Important limitation
OneDrive version history	Earlier versions of individual files and folders	Retention varies by account and plan
OneDrive restore feature	A broad rollback to an earlier point in time	The available window may be limited
Google Drive file versions	Older versions of supported files	Some versions can expire or be removed
Drive trash	Deleted healthy copies or folders	Trash may be automatically emptied
Offline backup	External drive, NAS, or backup service	It must have been disconnected or protected
Security or IT administrator	Audit logs, retention policies, and snapshots	Access depends on the organization

Restore a small sample first. Confirm that the files open normally, contain expected data, and are free of suspicious macros or scripts. Large restores should go to a clean, isolated location rather than directly into the folder watched by the infected sync client.

Recover files without spreading malware

Before recovery, create a forensic copy of encrypted files and ransom notes if storage is available. Do not send private documents to random “recovery” websites. Search reputable security organizations and malware research resources for a decryptor that matches the ransomware family, and verify that the tool is genuine before running it.

If no decryptor exists, version history and offline backups are usually safer options than paying. Ransom payments do not guarantee a working key, may fund further criminal activity, and can expose victims to additional fraud. A professional incident-response provider may help with complex business cases, but recovery still depends on the available copies.

Clean the operating system from trusted installation media or a controlled security environment when necessary. For Windows systems, the Safe Mode cleanup steps can help isolate startup malware and run security tools with fewer unwanted processes active.

Protect cloud accounts and connected devices

Change the cloud account password from a clean device, beginning with the email account that can reset it. Enable multifactor authentication, revoke unfamiliar sessions, review connected applications, and remove unknown recovery addresses or phone numbers. Business administrators should inspect sign-in logs and force password resets when several users may be affected.

Look for suspicious browser extensions, remote-access tools, scheduled tasks, and newly installed applications. Extensions can access cloud documents and session data, so remove anything unnecessary and investigate malicious browser extensions before signing in again.

Reconnect synchronization only after the device is clean and the account is secure. Start with a newly created folder, enable selective sync where practical, and watch for unexpected renames or rapid file changes. Keep restored data outside the original path until the process has been tested.

Reduce the risk of another encryption event

Build recovery around multiple copies rather than relying on synchronization alone. At least one backup should be offline, immutable, or otherwise protected from ordinary account credentials. Test file restoration periodically because a backup that has never been verified may be incomplete or unusable.

Useful safeguards include:

• Enable multifactor authentication for cloud, email, and administrator accounts.
• Keep operating systems, browsers, security software, and cloud clients updated.
• Use separate administrator and everyday user accounts.
• Limit shared-folder permissions and remove inactive users promptly.
• Maintain versioned backups and test them with sample file restores.

Document the provider’s retention period and the steps required to restore a large folder. Store emergency recovery codes securely, and make sure more than one trusted administrator can respond if the primary account is locked.

When cloud-synced files are encrypted, quick isolation preserves more recovery choices. Disconnect the suspected device, secure the account, identify the ransomware, and restore only from verified clean versions or backups. Use trusted malware-removal guidance and treat every restored file as untrusted until the system and data have been checked.