Emsisoft

Emsisoft Ltd. (est. 2003) is a New Zealand-based anti-virus software distributed company.^[1][2] They are notable for decrypting ransomware attacks^[3] to restore data.^[4]

Emsisoft is an anti-malware and cybersecurity software and consulting company founded in Austria in 2003 by Christian Mairoll.^[5][6] The company makes anti-malware software and decryption tools used by companies and individuals to help them recover computer files encrypted in ransomware attacks.^[7][8] It also tracks and generates studies on ransomware attacks.^[9][10]

Mairoll, who is CEO, relocated to rural New Zealand in 2014,^[11] moving Emsisoft’s headquarters to the country, while its employees across Europe, Asia and the United States remained remote.^[12][5]

In 2019, Emsisoft donated decryption tools to Europol's No More Ransom project.^[13] The company’s decryption tools were also used to help resolve the Kaseya VSA ransomware attack,^[14] DarkSide and BlackMatter ransomware attacks against dozens of companies across the U.S., Europe and Britain in 2021.^[15][16]

Ireland’s National Cyber Security Centre used Emsisoft’s decryption tools in May 2021 to help the country's health service department recover from a ransomware attack.^[17]

In early 2021, Emsisoft suffered a system data breach due to a configuration error, leading to the release of a database containing log records, including email addresses, generated by Emsisoft, that were accessed by at least one unauthorized individual.^[18] After detecting the attack, Emsisoft implemented security mechanisms, including disconnecting the compromised system and investigated the incident using forensic analysis. Customers were notified and Emsisoft issued a public apology for the incident.^[19]

Emsisoft's anti-malware technology is called Emsisoft Anti-Malware and has three versions: Anti-Malware Home, Business Security and Enterprise Security.^[7][8][20] The company also makes an extension for the web browsers Google Chrome, Firefox and Microsoft Edge that enables blocking access to malicious and phishing websites.^[20]