Ransomware and locally synced Google Drive files

When ransomware encrypts your Google Drive synced files locally, the desktop client may upload the unreadable replacement to Google Drive. Files can remain visible in the web interface while their contents are actually encrypted data. That makes this a sync and account-compromise incident until a clean comparison proves the files themselves are intact in the cloud.

The immediate priority is to stop the encryption and prevent damaged versions from propagating. Disconnect the affected computer from the network, pause Google Drive syncing if the interface still responds, and avoid paying the ransom or deleting the encrypted evidence. Reinstalling the sync client, using Google Drive reset, or emptying the local folder can remove useful local copies without repairing the cloud version.

Small businesses and hybrid teams in Sydney, Melbourne and Brisbane often keep working documents in Google Workspace while staff move between office laptops and home desktops. A single stolen browser session, malicious attachment or compromised shared drive can therefore affect staff laptops and local file mirrors, even when Google’s service itself has not been hacked.

For Australian organisations, encrypted files may contain personal information covered by the Privacy Act 1988. If the breach is likely to cause serious harm and reasonable remedial action is unlikely, the Notifiable Data Breaches scheme can require notification to the Office of the Australian Information Commissioner and affected people. Keep incident records so this decision is based on the actual files and systems affected.

Observation	What it may mean	Immediate response
Local file is unreadable, but the web version opens	Damage may be confined to that computer	Isolate the device, pause sync and compare versions
The web version is unreadable too	Ciphertext may have synchronised to the cloud	Revoke sessions, preserve a sample and restore an older version
A file is missing, but an earlier version is visible	The current file may have been deleted or replaced	Keep the current state and recover to a separate folder
Several devices or accounts are affected	Credentials, extensions or shared access may be compromised	Disconnect devices and audit Google Workspace access

Contain local sync and stop further uploads

On a home or small-office NBN connection, unplug Ethernet and switch off Wi-Fi; on a managed network, ask the IT administrator to isolate the device. If names, sizes or timestamps are still changing, power the machine down after isolating it. Do not reconnect merely to check email, open Drive or ask another device to trust the network.

Before launching a scanner, use the terminate malicious processes procedure to stop known hostile programs that can block cleanup. It is containment rather than proof of cleanliness, so follow it with an offline security scan. Pause syncing from the Drive menu when possible, then preserve the encrypted folder, ransom note and representative files on clean storage without changing their names or extensions. Do not delete the local Google Drive folder or reset the client before checking the cloud version.

Compare the local and cloud states

From a separate trusted device, open Drive on the web and inspect the affected folder, shared drives, recent activity and version history. A readable web copy paired with an unreadable local file suggests local-only damage; an unreadable web copy suggests the encrypted payload was synchronised upward. Record filenames, modified dates, affected users and whether shortcuts or shared links changed.

Restore a known-good prior version, where available, into a new folder that is not synchronised yet. Download copies to clean storage first, test that Word documents, spreadsheets, PDFs and images open correctly, and then reintroduce them gradually. If no clean version exists, keep the encrypted original because it may be needed by a reputable family-specific decryptor or a recovery specialist.

Clean the device and secure the account

Treat the infected computer, its browser and the Google account as connected problems. From a clean device, change the Google password, revoke other sessions and suspicious third-party app grants, review account devices, and enable multifactor authentication or a passkey. For Google Workspace, an administrator should check audit logs, shared-drive membership and forwarding rules used by affected staff.

Ransomware frequently arrives through a trojan, fake installer, malicious email attachment or compromised browser extension. If the browser downloaded an unexpected file or changed Drive-related settings, remove the extension from a clean browser and follow browser extension malware guidance before signing back in. On Windows, use Microsoft Defender Offline and Safe Mode checks; on Mac, update the system, remove suspicious login items and browser profiles, and replace credentials exposed on the device.

Recover files without overwriting evidence

Do not trust a pop-up promising instant decryption, and do not repeatedly rename or convert damaged files. Some ransomware families have public decryptors, while others require specialist file-recovery work. Keep one untouched sample with its original extension, test any tool on copies, and record the ransomware family, ransom note, sample file hash and affected directories.

Australian incident support is available through Australian Cyber Security Centre and Australian Signals Directorate guidance, while eligible small organisations can use Cyber Security Evaluate. Businesses should also notify their cyber insurer and managed service provider early because policy terms may require prompt contact. Australian consumers can use Scamwatch and law-enforcement reporting channels, although paying a ransom does not guarantee a usable key or deletion of stolen data.

Prevent recurrence and verify recovery

Google Drive sync and version history are useful collaboration tools, but they are not a backup when every connected device can overwrite the same file. Maintain three copies on separate media, including one offline or immutable copy, and rehearse quarterly restores. Keep encrypted originals and clean recovered versions in separate paths so a future infection cannot synchronise over the recovery set.

Australian small businesses often rely on an outsourced IT provider or cyber-insurance policy for ransomware readiness. Review access to shared drives, remove stale members, use separate administrator accounts and check policy coverage before an incident. For households, pause syncing sensitive folders on unmanaged devices, enable multifactor authentication and keep systems and browser extensions current. Close the incident only after each recovered file has been verified and every reconnected computer has passed a clean security check.